Attachment #8476211 for bug #1001090

Attachment #8476211: Rollup of parts 1-3 for fuzzing for bug #1001090

View | Details | Raw Unified | Return to bug 1001090
Collapse All | Expand All





    JS_OPTIMIZED_ARGUMENTS,      /* optimized-away 'arguments' value */
    JS_IS_CONSTRUCTING,          /* magic value passed to natives to indicate construction */
    JS_OVERWRITTEN_CALLEE,       /* arguments.callee has been overwritten */
    JS_BLOCK_NEEDS_CLONE,        /* value of static block object slot */
    JS_HASH_KEY_EMPTY,           /* see class js::HashableValue */
    JS_ION_ERROR,                /* error while running Ion code */
    JS_ION_BAILOUT,              /* missing recover instruction result */
    JS_OPTIMIZED_OUT,            /* optimized out slot */
    JS_UNINITIALIZED_LET,        /* uninitialized let bindings that produce ReferenceError on
                                  * touch. */
    JS_GENERIC_MAGIC             /* for local use */
} JSWhyMagic;

#if defined(IS_LITTLE_ENDIAN)
# if defined(JS_NUNBOX32)
typedef union jsval_layout
{
    uint64_t asBits;





    // We can specialize a bit for the given scope chain if that scope chain is the global object.
    JSObject *globalScope =
        scopeChain && scopeChain == &scopeChain->global() ? (JSObject*) scopeChain : nullptr;
    JS_ASSERT_IF(globalScope, globalScope->isNative());
    JS_ASSERT_IF(globalScope, JSCLASS_HAS_GLOBAL_FLAG_AND_SLOTS(globalScope->getClass()));

    BytecodeEmitter::EmitterMode emitterMode =
        options.selfHostingMode ? BytecodeEmitter::SelfHosting : BytecodeEmitter::Normal;
    BytecodeEmitter bce(/* parent = */ nullptr, &parser, &globalsc, script,
                        /* lazyScript = */ js::NullPtr(), options.forEval,
                        evalCaller, !!globalScope, options.lineno, emitterMode);
    if (!bce.init())
        return nullptr;

    // Syntax parsing may cause us to restart processing of top level
    // statements in the script. Use Maybe<> so that the parse context can be
    // reset when this occurs.
    Maybe<ParseContext<FullParseHandler> > pc;

    if (Emit1(cx, &bce, JSOP_RETRVAL) < 0)
        return nullptr;

    // Global/eval script bindings are always empty (all names are added to the
    // scope dynamically via JSOP_DEFFUN/VAR).  They may have block-scoped
    // locals, however, which are allocated to the fixed part of the stack
    // frame.
    InternalHandle<Bindings*> bindings(script, &script->bindings);
    if (!Bindings::initWithTemporaryStorage(cx, bindings, 0, 0, 0,
                                            pc->blockScopeDepth, nullptr))
    {
        return nullptr;
    }

    if (!JSScript::fullyInitFromEmitter(cx, script, &bce))
        return nullptr;

    // Note that this marking must happen before we tell Debugger
    // about the new script, in case Debugger delazifies the script's
    // inner functions.
    if (options.forEval)


    if (lazy->directlyInsideEval())
        script->setDirectlyInsideEval();
    if (lazy->usesArgumentsAndApply())
        script->setUsesArgumentsAndApply();
    if (lazy->hasBeenCloned())
        script->setHasBeenCloned();

    BytecodeEmitter bce(/* parent = */ nullptr, &parser, pn->pn_funbox, script, lazy,
                        options.forEval, /* evalCaller = */ js::NullPtr(),
                        /* hasGlobalScope = */ true, options.lineno,
                        BytecodeEmitter::LazyFunction);
    if (!bce.init())
        return false;

    if (lazy->treatAsRunOnce())
        bce.lazyRunOnceLambda = true;

    return EmitFunctionScript(cx, &bce, pn->pn_body);
}

// Compile a JS function body, which might appear as the value of an event
// handler attribute in an HTML <INPUT> tag, or in a Function() constructor.
static bool
CompileFunctionBody(JSContext *cx, MutableHandleFunction fun, const ReadOnlyCompileOptions &options,
                    const AutoNameVector &formals, SourceBufferHolder &srcBuf,

        /*
         * The reason for checking fun->environment() below is that certain
         * consumers of JS::CompileFunction, namely
         * EventListenerManager::CompileEventHandlerInternal, passes in a
         * nullptr environment. This compiled function is never used, but
         * instead is cloned immediately onto the right scope chain.
         */
        BytecodeEmitter funbce(/* parent = */ nullptr, &parser, fn->pn_funbox, script,
                               /* lazyScript = */ js::NullPtr(), /* insideEval = */ false,
                               /* evalCaller = */ js::NullPtr(),
                               fun->environment() && fun->environment()->is<GlobalObject>(),
                               options.lineno);
        if (!funbce.init())
            return false;

        if (!EmitFunctionScript(cx, &funbce, fn->pn_body))
            return false;
    } else {





        return static_cast<LoopStmtInfo*>(stmt);
    }
};

} // anonymous namespace

BytecodeEmitter::BytecodeEmitter(BytecodeEmitter *parent,
                                 Parser<FullParseHandler> *parser, SharedContext *sc,
                                 HandleScript script, Handle<LazyScript *> lazyScript,
                                 bool insideEval, HandleScript evalCaller,
                                 bool hasGlobalScope, uint32_t lineNum, EmitterMode emitterMode)
  : sc(sc),
    parent(parent),
    script(sc->context, script),
    lazyScript(sc->context, lazyScript),
    prolog(sc->context, lineNum),
    main(sc->context, lineNum),
    current(&main),
    parser(parser),
    evalCaller(evalCaller),
    topStmt(nullptr),
    topScopeStmt(nullptr),
    staticScope(sc->context),

    emitLevel(0),
    constList(sc->context),
    tryNoteList(sc->context),
    blockScopeList(sc->context),
    typesetCount(0),
    hasSingletons(false),
    emittingForInit(false),
    emittingRunOnceLambda(false),
    lazyRunOnceLambda(false),
    insideEval(insideEval),
    hasGlobalScope(hasGlobalScope),
    emitterMode(emitterMode)
{
    JS_ASSERT_IF(evalCaller, insideEval);
    JS_ASSERT_IF(emitterMode == LazyFunction, lazyScript);
}

bool
BytecodeEmitter::init()
{
    return atomIndices.ensureMap(sc->context);
}


    code[0] = jsbytecode(op);
    code[1] = op1;
    UpdateDepth(cx, bce, offset);
    return offset;
}

ptrdiff_t
frontend::Emit3(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op, jsbytecode op1,
                jsbytecode op2)
{
    /* These should filter through EmitVarOp. */
    JS_ASSERT(!IsArgOp(op));
    JS_ASSERT(!IsLocalOp(op));

    ptrdiff_t offset = EmitCheck(cx, bce, 3);
    if (offset < 0)
        return -1;


// In a function, block-scoped locals go after the vars, and form part of the
// fixed part of a stack frame.  Outside a function, there are no fixed vars,
// but block-scoped locals still form part of the fixed part of a stack frame
// and are thus addressable via GETLOCAL and friends.
static void
ComputeLocalOffset(ExclusiveContext *cx, BytecodeEmitter *bce, Handle<StaticBlockObject *> blockObj)
{
    unsigned nbodyfixed = bce->sc->isFunctionBox() ? bce->script->bindings.numBodyLevelLocals() : 0;
    unsigned localOffset = nbodyfixed;

    if (bce->staticScope) {
        Rooted<NestedScopeObject *> outer(cx, bce->staticScope);
        for (; outer; outer = outer->enclosingNestedScope()) {
            if (outer->is<StaticBlockObject>()) {
                StaticBlockObject &outerBlock = outer->as<StaticBlockObject>();
                localOffset = outerBlock.localOffset() + outerBlock.numVariables();
                break;
            }
        }
    }

    JS_ASSERT(localOffset + blockObj->numVariables()
              <= nbodyfixed + bce->script->bindings.numBlockScoped());

    blockObj->setLocalOffset(localOffset);
}

// ~ Nested Scopes ~
//
// A nested scope is a region of a compilation unit (function, script, or eval
// code) with an additional node on the scope chain.  This node may either be a

/*
 * To catch accidental misuse, EMIT_UINT16_IMM_OP/Emit3 assert that they are
 * not used to unconditionally emit JSOP_GETLOCAL. Variable access should
 * instead be emitted using EmitVarOp. In special cases, when the caller
 * definitely knows that a given local slot is unaliased, this function may be
 * used as a non-asserting version of EMIT_UINT16_IMM_OP.
 */
static bool
EmitLocalOp(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op, uint32_t slot)
{
    JS_ASSERT(JOF_OPTYPE(op) != JOF_SCOPECOORD);
    JS_ASSERT(IsLocalOp(op));

    ptrdiff_t off = EmitN(cx, bce, op, LOCALNO_LEN);
    if (off < 0)
        return false;

    SET_LOCALNO(bce->code(off), slot);
    return true;
}

static bool
EmitUnaliasedVarOp(ExclusiveContext *cx, JSOp op, uint32_t slot, bool checkUninitializedLet,
                   BytecodeEmitter *bce)
{
    JS_ASSERT(JOF_OPTYPE(op) != JOF_SCOPECOORD);

    if (IsLocalOp(op)) {
        if (checkUninitializedLet) {
            MOZ_ASSERT(op != JSOP_INITLET);
            if (!EmitLocalOp(cx, bce, JSOP_CHECKLET, slot))
                return false;
        }

        return EmitLocalOp(cx, bce, op, slot);
        return true;
    }

    JS_ASSERT(IsArgOp(op));
    ptrdiff_t off = EmitN(cx, bce, op, ARGNO_LEN);
    if (off < 0)
        return false;

    SET_ARGNO(bce->code(off), slot);
    return true;
}

static bool
EmitScopeCoordOp(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op, ScopeCoordinate sc)
{
    JS_ASSERT(JOF_OPTYPE(op) == JOF_SCOPECOORD);

    unsigned n = SCOPECOORD_HOPS_LEN + SCOPECOORD_SLOT_LEN;
    JS_ASSERT(int(n) + 1 /* op */ == js_CodeSpec[op].length);

    ptrdiff_t off = EmitN(cx, bce, op, n);
    if (off < 0)

    SET_SCOPECOORD_HOPS(pc, sc.hops());
    pc += SCOPECOORD_HOPS_LEN;
    SET_SCOPECOORD_SLOT(pc, sc.slot());
    pc += SCOPECOORD_SLOT_LEN;
    CheckTypeSet(cx, bce, op);
    return true;
}

static bool
EmitAliasedVarOp(ExclusiveContext *cx, JSOp op, ScopeCoordinate sc, bool checkUninitializedLet,
                 BytecodeEmitter *bce)
{
    if (checkUninitializedLet) {
        MOZ_ASSERT(op != JSOP_INITALIASEDLET);
        if (!EmitScopeCoordOp(cx, bce, JSOP_CHECKALIASEDLET, sc))
            return false;
    }

    return EmitScopeCoordOp(cx, bce, op, sc);
}

// Compute the number of nested scope objects that will actually be on the scope
// chain at runtime, given the BCE's current staticScope.
static unsigned
DynamicNestedScopeDepth(BytecodeEmitter *bce)
{
    unsigned depth = 0;
    for (NestedScopeObject *b = bce->staticScope; b; b = b->enclosingNestedScope()) {
        if (!b->is<StaticBlockObject>() || b->as<StaticBlockObject>().needsClone())
            ++depth;
    }

    return depth;
}

static bool
LookupAliasedName(BytecodeEmitter *bce, HandleScript script, PropertyName *name, uint32_t *pslot,
                  ParseNode *pn = nullptr)
{
    /*
     * Beware: BindingIter may contain more than one Binding for a given name
     * (in the case of |function f(x,x) {}|) but only one will be aliased.
     */
    uint32_t bindingIndex = 0;
    uint32_t slot = CallObject::RESERVED_SLOTS;
    for (BindingIter bi(script); !bi.done(); bi++) {
        if (bi->aliased()) {
            if (bi->name() == name) {
                // Check if the free variable from a lazy script was marked as
                // a possible hoisted use and is a let. If so, mark it as such
                // so we emit a dead zone check.
                if (bce->emitterMode == BytecodeEmitter::LazyFunction) {
                    LazyScript::FreeVariable *freeVariables = bce->lazyScript->freeVariables();
                    uint32_t letBegin = script->bindings.numArgs() + script->bindings.numVars();
                    for (uint32_t i = 0; i < bce->lazyScript->numFreeVariables(); i++) {
                        if (freeVariables[i].atom() == name) {
                            if (freeVariables[i].isHoistedUse() && bindingIndex >= letBegin) {
                                MOZ_ASSERT(pn);
                                MOZ_ASSERT(pn->isUsed());
                                pn->pn_dflags |= PND_LET;
                            }

                            break;
                        }
                    }
                }

                *pslot = slot;
                return true;
            }
            slot++;
        }
        bindingIndex++;
    }
    return false;
}

static bool
LookupAliasedNameSlot(BytecodeEmitter *bce, HandleScript script, PropertyName *name,
                      ScopeCoordinate *sc)
{
    uint32_t slot;
    if (!LookupAliasedName(bce, script, name, &slot))
        return false;

    sc->setSlot(slot);
    return true;
}

/*
 * Use this function instead of assigning directly to 'hops' to guard for

     * and so includes the full DynamicNestedScopeDepth. A let/catch-binding
     * requires a search of the block chain to see how many (dynamic) block
     * objects to skip.
     */
    ScopeCoordinate sc;
    if (IsArgOp(pn->getOp())) {
        if (!AssignHops(bce, pn, skippedScopes + DynamicNestedScopeDepth(bceOfDef), &sc))
            return false;
        JS_ALWAYS_TRUE(LookupAliasedNameSlot(bceOfDef, bceOfDef->script, pn->name(), &sc));
    } else {
        JS_ASSERT(IsLocalOp(pn->getOp()) || pn->isKind(PNK_FUNCTION));
        uint32_t local = pn->pn_cookie.slot();
        if (local < bceOfDef->script->bindings.numBodyLevelLocals()) {
            if (!AssignHops(bce, pn, skippedScopes + DynamicNestedScopeDepth(bceOfDef), &sc))
                return false;
            JS_ALWAYS_TRUE(LookupAliasedNameSlot(bceOfDef, bceOfDef->script, pn->name(), &sc));
        } else {
            JS_ASSERT_IF(bce->sc->isFunctionBox(), local <= bceOfDef->script->bindings.numLocals());
            JS_ASSERT(bceOfDef->staticScope->is<StaticBlockObject>());
            Rooted<StaticBlockObject*> b(cx, &bceOfDef->staticScope->as<StaticBlockObject>());
            while (local < b->localOffset()) {
                if (b->needsClone())
                    skippedScopes++;
                b = &b->enclosingNestedScope()->as<StaticBlockObject>();
            }
            if (!AssignHops(bce, pn, skippedScopes, &sc))
                return false;
            sc.setSlot(b->localIndexToSlot(local));
        }
    }

    return EmitAliasedVarOp(cx, op, sc, pn->isHoistedLetUse(), bce);
}

static bool
EmitVarOp(ExclusiveContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
{
    JS_ASSERT(pn->isKind(PNK_FUNCTION) || pn->isKind(PNK_NAME));
    JS_ASSERT(!pn->pn_cookie.isFree());

    if (IsAliasedVarOp(op)) {
        ScopeCoordinate sc;
        sc.setHops(pn->pn_cookie.level());
        sc.setSlot(pn->pn_cookie.slot());
        return EmitAliasedVarOp(cx, op, sc, pn->isHoistedLetUse(), bce);
    }

    JS_ASSERT_IF(pn->isKind(PNK_NAME), IsArgOp(op) || IsLocalOp(op));

    if (!bce->isAliasedName(pn)) {
        JS_ASSERT(pn->isUsed() || pn->isDefn());
        JS_ASSERT_IF(pn->isUsed(), pn->pn_cookie.level() == 0);
        JS_ASSERT_IF(pn->isDefn(), pn->pn_cookie.level() == bce->script->staticLevel());
        return EmitUnaliasedVarOp(cx, op, pn->pn_cookie.slot(), pn->isHoistedLetUse(), bce);
    }

    switch (op) {
      case JSOP_GETARG: case JSOP_GETLOCAL: op = JSOP_GETALIASEDVAR; break;
      case JSOP_SETARG: case JSOP_SETLOCAL: op = JSOP_SETALIASEDVAR; break;
      case JSOP_INITLET: op = JSOP_INITALIASEDLET; break;
      default: MOZ_CRASH("unexpected var op");
    }

    return EmitAliasedVarOp(cx, op, pn, bce);
}

static JSOp
GetIncDecInfo(ParseNodeKind kind, bool *post)

                    hops++;
                continue;
            }
            RootedScript script(bce->sc->context, ssi.funScript());
            if (script->functionNonDelazifying()->atom() == pn->pn_atom)
                return false;
            if (ssi.hasDynamicScopeObject()) {
                uint32_t slot;
                if (LookupAliasedName(bce, script, pn->pn_atom->asPropertyName(), &slot, pn)) {
                    JSOp op;
                    switch (pn->getOp()) {
                      case JSOP_NAME:    op = JSOP_GETALIASEDVAR; break;
                      case JSOP_SETNAME: op = JSOP_SETALIASEDVAR; break;
                      default: return false;
                    }

                    pn->setOp(op);
                    JS_ALWAYS_TRUE(pn->pn_cookie.set(bce->parser->tokenStream, hops, slot));
                    return true;
                }
                hops++;
            }

            if (script->funHasExtensibleScope() || script->directlyInsideEval())

        if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
            return false;
    }
    return true;
}

static bool
InitializeBlockScopedLocalsFromStack(ExclusiveContext *cx, BytecodeEmitter *bce,
                                     Handle<StaticBlockObject *> blockObj,
                                     uint32_t valuesPushed)
{
    for (unsigned i = valuesPushed; i > 0; --i) {
        if (blockObj->isAliased(i - 1)) {
            ScopeCoordinate sc;
            sc.setHops(0);
            sc.setSlot(BlockObject::RESERVED_SLOTS + i - 1);
            if (!EmitAliasedVarOp(cx, JSOP_INITALIASEDLET, sc,
                                  /* checkUninitializedLet = */ false, bce))
            {
                return false;
            }
        } else {
            unsigned local = blockObj->blockIndexToLocalIndex(i - 1);
            if (!EmitUnaliasedVarOp(cx, JSOP_INITLET, local,
                                    /* checkUninitializedLet = */ false, bce))
            {
                return false;
            }
        }
        if (Emit1(cx, bce, JSOP_POP) < 0)
            return false;
    }
    return true;
}

static bool
EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmtInfo,
                ObjectBox *objbox, unsigned valuesPushed = 0)
{
    // Initial values for block-scoped locals.
    Rooted<StaticBlockObject *> blockObj(cx, &objbox->object->as<StaticBlockObject>());
    if (!PushUndefinedValues(cx, bce, blockObj->numVariables() - alreadyPushed))
        return false;

    if (!EnterNestedScope(cx, bce, stmtInfo, objbox, STMT_BLOCK))
        return false;

    if (!InitializeBlockScopedLocalsFromStack(cx, bce, blockObj, valuesPushed))
        return false;

    return true;
}

static bool
EnterBlockScopeWithUndefined(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmtInfo,
                             ObjectBox *objbox, unsigned alreadyPushed = 0)
{
    // Initial values for block-scoped locals.
    Rooted<StaticBlockObject *> blockObj(cx, &objbox->object->as<StaticBlockObject>());
    unsigned undefinedsPushed = blockObj->numVariables() - alreadyPushed;
    if (!PushUndefinedValues(cx, bce, undefinedsPushed))
        return false;

    if (!EnterBlockScope(cx, bce, stmtInfo, objbox, undefinedsPushed))
        return false;

    return true;
}

/*
 * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047.
 * LLVM is deciding to inline this function which uses a lot of stack space


bool
BytecodeEmitter::isRunOnceLambda()
{
    // The run once lambda flags set by the parser are approximate, and we look
    // at properties of the function itself before deciding to emit a function
    // as a run once lambda.

    if (!(parent && parent->emittingRunOnceLambda) &&
        (emitterMode != LazyFunction || !lazyScript->treatAsRunOnce()))
    {
        return false;
    }

    FunctionBox *funbox = sc->asFunctionBox();
    return !funbox->argumentsHasLocalBinding() &&
           !funbox->isGenerator() &&
           !funbox->function()->name();
}

bool

        bce->switchToProlog();
        if (Emit1(cx, bce, JSOP_ARGUMENTS) < 0)
            return false;
        InternalBindingsHandle bindings(bce->script, &bce->script->bindings);
        uint32_t varIndex = Bindings::argumentsVarIndex(cx, bindings);
        if (bce->script->varIsAliased(varIndex)) {
            ScopeCoordinate sc;
            sc.setHops(0);
            JS_ALWAYS_TRUE(LookupAliasedNameSlot(bce, bce->script, cx->names().arguments, &sc));
            if (!EmitAliasedVarOp(cx, JSOP_SETALIASEDVAR, sc,
                                  /* checkUninitializedLet = */ false, bce))
            {
                return false;
            }
        } else {
            if (!EmitUnaliasedVarOp(cx, JSOP_SETLOCAL, varIndex,
                                    /* checkUninitializedLet = */ false, bce))
                return false;
        }
        if (Emit1(cx, bce, JSOP_POP) < 0)
            return false;
        bce->switchToMain();
    }

    if (funbox->isGenerator()) {

    DefineVars        = 0,
    PushInitialValues = 1,
    InitializeVars    = 2
};

typedef bool
(*DestructuringDeclEmitter)(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp, ParseNode *pn);

template <DestructuringDeclEmitter EmitName>
static bool
EmitDestructuringDeclsWithEmitter(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp,
                                  ParseNode *pattern)
    JS_ASSERT(pn->isKind(PNK_NAME));
    if (!BindNameToSlot(cx, bce, pn))
        return false;

    JS_ASSERT(!pn->isOp(JSOP_CALLEE));
    return MaybeEmitVarDecl(cx, bce, prologOp, pn, nullptr);
}

static bool
EmitDestructuringDecls(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp,
                       ParseNode *pattern)
{
    if (pattern->isKind(PNK_ARRAY)) {
        for (ParseNode *element = pattern->pn_head; element; element = element->pn_next) {
            if (element->isKind(PNK_ELISION))
                continue;

            if (element->isKind(PNK_NAME)) {
                if (!EmitName(cx, bce, prologOp, element))
                    return false;
            } else {
                if (!EmitDestructuringDeclsWithEmitter<EmitName>(cx, bce, prologOp, element))
                    return false;
            }
        }
        return true;
    }

    MOZ_ASSERT(pattern->isKind(PNK_OBJECT));
    for (ParseNode *member = pattern->pn_head; member; member = member->pn_next) {
        ParseNode *target = member->pn_right;

        if (target->isKind(PNK_NAME)) {
            if (!EmitName(cx, bce, prologOp, target))
                return false;
        } else {
            if (!EmitDestructuringDeclsWithEmitter<EmitName>(cx, bce, prologOp, target))
                return false;
        }
    }
    return true;
}

bool
EmitDestructuringDecl(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp, ParseNode *pn)
{
    JS_ASSERT(pn->isKind(PNK_NAME));
    if (!BindNameToSlot(cx, bce, pn))
        return false;

    JS_ASSERT(!pn->isOp(JSOP_CALLEE));
    return MaybeEmitVarDecl(cx, bce, prologOp, pn, nullptr);
}

static inline bool
EmitDestructuringDecls(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp,
                       ParseNode *pattern)
{
    return EmitDestructuringDeclsWithEmitter<EmitDestructuringDecl>(cx, bce, prologOp, pattern);
}

bool
EmitInitializeDestructuringDecl(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp,
                                ParseNode *pn)
{
    MOZ_ASSERT(pn->isKind(PNK_NAME));
    MOZ_ASSERT(pn->isBound());
    return EmitVarOp(cx, pn, pn->getOp(), bce);
}

// Emit code to initialize all destructured names to the value on the top of
// the stack.
static inline bool
EmitInitializeDestructuringDecls(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp,
                                 ParseNode *pattern)
{
    return EmitDestructuringDeclsWithEmitter<EmitInitializeDestructuringDecl>(cx, bce,
                                                                              prologOp, pattern);
}

static bool
EmitDestructuringOpsHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn,
                           VarEmitOption emitOption);

/*
 * EmitDestructuringLHS assumes the to-be-destructured value has been pushed on
 * the stack and emits code to destructure a single lhs expression (either a
 * name or a compound []/{} expression).

            // Per its post-condition, EmitDestructuringOpsHelper has left the
            // to-be-destructured value on top of the stack.
            if (Emit1(cx, bce, JSOP_POP) < 0)
                return false;
        }
    } else if (emitOption == PushInitialValues) {
        // The lhs is a simple name so the to-be-destructured value is
        // its initial value and there is nothing to do.
        JS_ASSERT(pn->getOp() == JSOP_SETLOCAL || pn->getOp() == JSOP_INITLET);
        JS_ASSERT(pn->pn_dflags & PND_BOUND);
    } else {
        switch (pn->getKind()) {
          case PNK_NAME:
            if (!BindNameToSlot(cx, bce, pn))
                return false;

            // Allow 'const [x,y] = o', make 'const x,y; [x,y] = o' a nop.


                if (!EmitIndexOp(cx, pn->getOp(), atomIndex, bce))
                    return false;
                break;
              }

              case JSOP_SETLOCAL:
              case JSOP_SETARG:
              case JSOP_INITLET:
                if (!EmitVarOp(cx, pn, pn->getOp(), bce))
                    return false;
                break;

              default:
                MOZ_CRASH("EmitDestructuringLHS: bad name op");
            }
            break;

        }

    }
    return true;
}

static bool
EmitVariables(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, VarEmitOption emitOption,
              bool isLetExpr = false)
{
    JS_ASSERT(pn->isArity(PN_LIST));
    JS_ASSERT(isLetExpr == (emitOption == PushInitialValues));

    ParseNode *next;
    for (ParseNode *pn2 = pn->pn_head; ; pn2 = next) {
        if (!UpdateSourceCoordNotes(cx, bce, pn2->pn_pos.begin))
            return false;
        next = pn2->pn_next;

        ParseNode *pn3;
        if (!pn2->isKind(PNK_NAME)) {
            if (pn2->isKind(PNK_ARRAY) || pn2->isKind(PNK_OBJECT)) {
                // If the emit option is DefineVars, emit variable binding
                // ops, but not destructuring ops.  The parser (see
                // Parser::variables) has ensured that our caller will be the
                // PNK_FOR/PNK_FORIN/PNK_FOROF case in EmitTree, and that case
                // will emit the destructuring code only after emitting an
                // enumerating opcode and a branch that tests whether the
                // enumeration ended.
                //
                // Otherwise this is emitting destructuring let binding
                // initialization for a legacy comprehension expression. See
                // EmitForInOrOfVariables.
                JS_ASSERT(pn->pn_count == 1);
                if (emitOption == DefineVars) {
                    if (!EmitDestructuringDecls(cx, bce, pn->getOp(), pn2))
                        return false;
                } else {
                    // 'let' bindings cannot be used before they are
                    // initialized. Similar to the JSOP_INITLET case below.
                    MOZ_ASSERT(emitOption != DefineVars);
                    MOZ_ASSERT_IF(emitOption == InitializeVars, pn->pn_xflags & PNX_POPVAR);
                    if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
                        return false;
                    if (!EmitInitializeDestructuringDecls(cx, bce, pn->getOp(), pn2))
                        return false;
                }
                break;
            }

            /*
             * A destructuring initialiser assignment preceded by var will
             * never occur to the left of 'in' in a for-in loop.  As with 'for
             * (var x = i in o)...', this will cause the entire 'var [a, b] =
             * i' to be hoisted out of the loop.

            if (pn->pn_count == 1) {
                /*
                 * If this is the only destructuring assignment in the list,
                 * try to optimize to a group assignment.  If we're in a let
                 * head, pass JSOP_POP rather than the pseudo-prolog JSOP_NOP
                 * in pn->pn_op, to suppress a second (and misplaced) 'let'.
                 */
                JS_ASSERT(!pn2->pn_next);
                if (isLetExpr) {
                    if (!MaybeEmitLetGroupDecl(cx, bce, pn2, &op))
                        return false;
                } else {
                    if (!MaybeEmitGroupAssignment(cx, bce, pn->getOp(), pn2, GroupIsDecl, &op))
                        return false;
                }
            }
            if (op == JSOP_NOP) {

            } else {
                pn3 = pn2->pn_left;
                if (!EmitDestructuringDecls(cx, bce, pn->getOp(), pn3))
                    return false;

                if (!EmitTree(cx, bce, pn2->pn_right))
                    return false;

                if (!EmitDestructuringOps(cx, bce, pn3, isLetExpr))
                    return false;
            }

            /* If we are not initializing, nothing to pop. */
            if (emitOption != InitializeVars) {
                if (next)
                    continue;
                break;

                    return false;
            }

            bool oldEmittingForInit = bce->emittingForInit;
            bce->emittingForInit = false;
            if (!EmitTree(cx, bce, pn3))
                return false;
            bce->emittingForInit = oldEmittingForInit;
        } else if (op == JSOP_INITLET || isLetExpr) {
            // 'let' bindings cannot be used before they are
            // initialized. JSOP_INITLET distinguishes the binding site.
            MOZ_ASSERT(emitOption != DefineVars);
            MOZ_ASSERT_IF(emitOption == InitializeVars, pn->pn_xflags & PNX_POPVAR);
            if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
                return false;
        }

        // If we are not initializing, nothing to pop. If we are initializing
        // lets, we must emit the pops.
        if (emitOption != InitializeVars) {
            if (next)
                continue;
            break;
        }

        JS_ASSERT_IF(pn2->isDefn(), pn3 == pn2->pn_expr);
        if (!pn2->pn_cookie.isFree()) {

            return false;
        if (Emit1(cx, bce, JSOP_POP) < 0)
            return false;
        break;

      case PNK_NAME:
        /* Inline and specialize BindNameToSlot for pn2. */
        JS_ASSERT(!pn2->pn_cookie.isFree());
        if (!EmitVarOp(cx, pn2, JSOP_INITLET, bce))
            return false;
        if (Emit1(cx, bce, JSOP_POP) < 0)
            return false;
        break;

      default:
        JS_ASSERT(0);
    }

    JS_ASSERT(letBody->isLet() && letBody->isKind(PNK_LEXICALSCOPE));

    int letHeadDepth = bce->stackDepth;

    if (!EmitVariables(cx, bce, varList, PushInitialValues, true))
        return false;

    /* Push storage for hoisted let decls (e.g. 'let (x) { let y }'). */
    uint32_t valuesPushed = bce->stackDepth - letHeadDepth;
    StmtInfoBCE stmtInfo(cx);
    if (!EnterBlockScope(cx, bce, &stmtInfo, letBody->pn_objbox, valuesPushed))
        return false;

    if (!EmitTree(cx, bce, letBody->pn_expr))
        return false;

    if (!LeaveNestedScope(cx, bce, &stmtInfo))
        return false;


    if (Emit1(cx, bce, JSOP_SWAP) < 0)                         // @@ITERATOR OBJ
        return false;
    if (EmitCall(cx, bce, JSOP_CALL, 0) < 0)                   // ITER
        return false;
    CheckTypeSet(cx, bce, JSOP_CALL);
    return true;
}

static bool
EmitForInOrOfVariables(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, bool *letDecl)
{
    *letDecl = pn->isKind(PNK_LEXICALSCOPE);
    MOZ_ASSERT_IF(*letDecl, pn->isLet());

    // If the left part is 'var x', emit code to define x if necessary using a
    // prolog opcode, but do not emit a pop. If it is 'let x', we don't need
    // to do anything here. EnterBlockScopeWithUndefined will initialize let
    // bindings in EmitForOf and EmitForIn.
    //
    // Due to the horror of legacy comprehensions, there is a third case where
    // we have PNK_LET without a lexical scope, because those expressions are
    // parsed with single lexical scope for the entire comprehension. In this
    // case we must initialize the lets to not trigger dead zone checks via
    // InitializeVars.
    if (pn && !*letDecl) {
        bce->emittingForInit = true;
        if (pn->isKind(PNK_VAR)) {
            if (!EmitVariables(cx, bce, pn, DefineVars))
                return false;
        } else {
            MOZ_ASSERT(pn->isKind(PNK_LET));
            if (!EmitVariables(cx, bce, pn, InitializeVars))
                return false;
        }
        bce->emittingForInit = false;
    }

    return true;
}


/**
 * If type is STMT_FOR_OF_LOOP, it emits bytecode for for-of loop.
 * pn should be PNK_FOR, and pn->pn_left should be PNK_FOROF.
 *
 * If type is STMT_SPREAD, it emits bytecode for spread operator.
 * pn should be nullptr.
 * Please refer the comment above EmitSpread for additional information about
 * stack convention.

    JS_ASSERT(type == STMT_FOR_OF_LOOP || type == STMT_SPREAD);
    JS_ASSERT_IF(type == STMT_FOR_OF_LOOP, pn && pn->pn_left->isKind(PNK_FOROF));
    JS_ASSERT_IF(type == STMT_SPREAD, !pn);

    ParseNode *forHead = pn ? pn->pn_left : nullptr;
    ParseNode *forBody = pn ? pn->pn_right : nullptr;

    ParseNode *pn1 = forHead ? forHead->pn_kid1 : nullptr;
    bool letDecl = false;
    if (pn1 && !EmitForInOrOfVariables(cx, bce, pn1, &letDecl))
        return false;
    // If the left part is 'var x', emit code to define x if necessary using a
    // prolog opcode, but do not emit a pop.
    if (pn1) {
        ParseNode *decl = letDecl ? pn1->pn_expr : pn1;
        JS_ASSERT(decl->isKind(PNK_VAR) || decl->isKind(PNK_LET));
        bce->emittingForInit = true;
        if (!EmitVariables(cx, bce, decl, DefineVars))
            return false;
        bce->emittingForInit = false;
    }

    if (type == STMT_FOR_OF_LOOP) {
        // For-of loops run with two values on the stack: the iterator and the
        // current result object.

        // Compile the object expression to the right of 'of'.
        if (!EmitTree(cx, bce, forHead->pn_kid3))
            return false;

        // the stack.
        if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)2) < 0)      // I ITER ARR
            return false;
        if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)2) < 0)      // ITER ARR I
            return false;
    }

    // Enter the block before the loop body, after evaluating the obj.
    // Initialize let bindings with undefined when entering, as the name
    // assigned to is a plain assignment.
    StmtInfoBCE letStmt(cx);
    if (letDecl) {
        if (!EnterBlockScopeWithUndefined(cx, bce, &letStmt, pn1->pn_objbox, 0))
            return false;
    }

    LoopStmtInfo stmtInfo(cx);
    PushLoopStatement(bce, &stmtInfo, type, top);

    // Jump down to the loop condition to minimize overhead assuming at least
    // one iteration, as the other loop forms do.  Annotate so IonMonkey can


static bool
EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
{
    ParseNode *forHead = pn->pn_left;
    ParseNode *forBody = pn->pn_right;

    ParseNode *pn1 = forHead->pn_kid1;
    bool letDecl = false;
    if (pn1 && !EmitForInOrOfVariables(cx, bce, pn1, &letDecl))
        return false;
    /*
     * If the left part is 'var x', emit code to define x if necessary
     * using a prolog opcode, but do not emit a pop. If the left part was
     * originally 'var x = i', the parser will have rewritten it; see
     * Parser::forStatement. 'for (let x = i in o)' is mercifully banned.
     */
    if (pn1) {
        ParseNode *decl = letDecl ? pn1->pn_expr : pn1;
        JS_ASSERT(decl->isKind(PNK_VAR) || decl->isKind(PNK_LET));
        bce->emittingForInit = true;
        if (!EmitVariables(cx, bce, decl, DefineVars))
            return false;
        bce->emittingForInit = false;
    }

    /* Compile the object expression to the right of 'in'. */
    if (!EmitTree(cx, bce, forHead->pn_kid3))
        return false;

    /*
     * Emit a bytecode to convert top of stack value to the iterator
     * object depending on the loop variant (for-in, for-each-in, or
     * destructuring for-in).
     */
    JS_ASSERT(pn->isOp(JSOP_ITER));
    if (Emit2(cx, bce, JSOP_ITER, (uint8_t) pn->pn_iflags) < 0)
        return false;

    // Enter the block before the loop body, after evaluating the obj.
    // Initialize let bindings with undefined when entering, as the name
    // assigned to is a plain assignment.
    StmtInfoBCE letStmt(cx);
    if (letDecl) {
        if (!EnterBlockScopeWithUndefined(cx, bce, &letStmt, pn1->pn_objbox, 0))
            return false;
    }

    LoopStmtInfo stmtInfo(cx);
    PushLoopStatement(bce, &stmtInfo, STMT_FOR_IN_LOOP, top);

    /* Annotate so IonMonkey can find the loop-closing jump. */
    int noteIndex = NewSrcNote(cx, bce, SRC_FOR_IN);

                                                          sourceObject,
                                                          funbox->bufStart, funbox->bufEnd));
            if (!script)
                return false;

            script->bindings = funbox->bindings;

            uint32_t lineNum = bce->parser->tokenStream.srcCoords.lineNum(pn->pn_pos.begin);
            BytecodeEmitter bce2(bce, bce->parser, funbox, script, /* lazyScript = */ js::NullPtr(),
                                 bce->insideEval, bce->evalCaller, bce->hasGlobalScope, lineNum,
                                 bce->emitterMode);
            if (!bce2.init())
                return false;

            /* We measured the max scope depth when we parsed the function. */
            if (!EmitFunctionScript(cx, &bce2, pn->pn_body))
                return false;






    typedef StmtInfoBCE StmtInfo;

    SharedContext   *const sc;      /* context shared between parsing and bytecode generation */

    BytecodeEmitter *const parent;  /* enclosing function or global context */

    Rooted<JSScript*> script;       /* the JSScript we're ultimately producing */

    Rooted<LazyScript *> lazyScript; /* the lazy script if mode is LazyFunction,
                                        nullptr otherwise. */

    struct EmitSection {
        BytecodeVector code;        /* bytecode */
        SrcNotesVector notes;       /* source notes, see below */
        ptrdiff_t   lastNoteOffset; /* code offset for last source note */
        uint32_t    currentLine;    /* line number for tree-based srcnote gen */
        uint32_t    lastColumn;     /* zero-based column index on currentLine of
                                       last SRC_COLSPAN-annotated opcode */


    uint16_t        typesetCount;   /* Number of JOF_TYPESET opcodes generated */

    bool            hasSingletons:1;    /* script contains singleton initializer JSOP_OBJECT */

    bool            emittingForInit:1;  /* true while emitting init expr of for; exclude 'in' */

    bool            emittingRunOnceLambda:1; /* true while emitting a lambda which is only
                                                expected to run once. */
    bool            lazyRunOnceLambda:1; /* true while lazily emitting a script for
                                          * a lambda which is only expected to run once. */

    bool isRunOnceLambda();

    bool            insideEval:1;       /* True if compiling an eval-expression or a function
                                           nested inside an eval. */

    const bool      hasGlobalScope:1;   /* frontend::CompileScript's scope chain is the
                                           global object */


    /*
     * Note that BytecodeEmitters are magic: they own the arena "top-of-stack"
     * space above their tempMark points. This means that you cannot alloc from
     * tempLifoAlloc and save the pointer beyond the next BytecodeEmitter
     * destruction.
     */
    BytecodeEmitter(BytecodeEmitter *parent, Parser<FullParseHandler> *parser, SharedContext *sc,
                    HandleScript script, Handle<LazyScript *> lazyScript,
                    bool insideEval, HandleScript evalCaller, bool hasGlobalScope,
                    uint32_t lineNum, EmitterMode emitterMode = Normal);
    bool init();

    bool isAliasedName(ParseNode *pn);

    MOZ_ALWAYS_INLINE
    bool makeAtomIndex(JSAtom *atom, jsatomid *indexp) {
        AtomIndexAddPtr p = atomIndices->lookupForAdd(atom);
        if (p) {





    inline ParseNode *makeAssignment(ParseNode *pn, ParseNode *rhs);

    static Definition *getDefinitionNode(Definition *dn) {
        return dn;
    }
    static Definition::Kind getDefinitionKind(Definition *dn) {
        return dn->kind();
    }
    static bool isPlaceholderDefinition(Definition *dn) {
        return dn->isPlaceholder();
    }
    void linkUseToDef(ParseNode *pn, Definition *dn)
    {
        JS_ASSERT(!pn->isUsed());
        JS_ASSERT(!pn->isDefn());
        JS_ASSERT(pn != dn->dn_uses);
        JS_ASSERT(dn->isDefn());
        pn->pn_link = dn->dn_uses;
        dn->dn_uses = pn;

            JS_ASSERT(!pnu->isDefn());
            if (pnu->pn_pos.begin >= pos.begin && pnu->pn_pos.end <= pos.end)
                pnu->pn_dflags |= PND_DEOPTIMIZED;
        }
    }
    bool dependencyCovered(ParseNode *pn, unsigned blockid, bool functionScope) {
        return pn->pn_blockid >= blockid;
    }
    void markMaybeUninitializedLetUseInSwitch(ParseNode *pn, Definition *dn,
                                              uint16_t firstDominatingLetSlot)
    {
        MOZ_ASSERT(pn->isUsed());
        if (dn->isLet() && dn->pn_cookie.slot() < firstDominatingLetSlot)
            pn->pn_dflags |= PND_LET;
    }

    static uintptr_t definitionToBits(Definition *dn) {
        return uintptr_t(dn);
    }
    static Definition *definitionFromBits(uintptr_t bits) {
        return (Definition *) bits;
    }
    static Definition *nullDefinition() {

    if (pn->isUsed()) {
        pn = makeAssignment(pn, init);
        if (!pn)
            return false;
    } else {
        pn->pn_expr = init;
    }

    if (op == JSOP_INITLET)
        pn->setOp(op);
    else if (pn->pn_dflags & PND_BOUND)
        pn->setOp(JSOP_SETLOCAL);
    else if (op == JSOP_DEFCONST)
        pn->setOp(JSOP_SETCONST);
    else
        pn->setOp(JSOP_SETNAME);

    pn->markAsAssigned();

    /* The declarator's position must include the initializer. */
    pn->pn_pos.end = init->pn_pos.end;
    return true;
}






        if (opn->isUsed()) {
            /*
             * The old name is a use of its pn_lexdef. Make the clone also be a
             * use of that definition.
             */
            Definition *dn = pn->pn_lexdef;

            pn->pn_link = dn->dn_uses;
            pn->pn_dflags = opn->pn_dflags;
            dn->dn_uses = pn;
        } else if (opn->pn_expr) {
            NULLCHECK(pn->pn_expr = cloneParseTree(opn->pn_expr));

            /*
             * If the old name is a definition, the new one has pn_defn set.
             * Make the old name a use of the new node.
             */


        pn->pn_link = dn->dn_uses;
        dn->dn_uses = pn;
    } else {
        pn->pn_expr = nullptr;
        if (opn->isDefn()) {
            /* We copied some definition-specific state into pn. Clear it out. */
            pn->pn_cookie.makeFree();
            pn->pn_dflags &= ~(PND_LET | PND_BOUND);
            pn->setDefn(false);

            handler.linkUseToDef(pn, (Definition *) opn);
        }
    }
    return pn;
}






    }

    ParseNode  *maybeExpr()   { return pn_used ? nullptr : expr(); }
    Definition *maybeLexDef() { return pn_used ? lexdef() : nullptr; }

    Definition *resolve();

/* PN_CODE and PN_NAME pn_dflags bits. */
#define PND_LET                 0x01    /* let (block-scoped) binding or use of a hoisted let */
#define PND_CONST               0x02    /* const binding (orthogonal to let) */
#define PND_ASSIGNED            0x04    /* set if ever LHS of assignment */
#define PND_PLACEHOLDER         0x08    /* placeholder definition for lexdep */
#define PND_BOUND               0x10    /* bound to a stack or global slot */
#define PND_DEOPTIMIZED         0x20    /* former pn_used name node, pn_lexdef
                                           still valid, but this use no longer
                                           optimizable via an upvar opcode */
#define PND_CLOSED              0x40    /* variable is closed over */

            if (kid && kid->getKind() == PNK_STRING && !kid->pn_parens)
                return kid->pn_atom;
        }
        return nullptr;
    }

    inline bool test(unsigned flag) const;

    bool isLet() const          { return test(PND_LET) && !isUsed(); }
    bool isConst() const        { return test(PND_CONST); }
    bool isPlaceholder() const  { return test(PND_PLACEHOLDER); }
    bool isDeoptimized() const  { return test(PND_DEOPTIMIZED); }
    bool isAssigned() const     { return test(PND_ASSIGNED); }
    bool isClosed() const       { return test(PND_CLOSED); }
    bool isBound() const        { return test(PND_BOUND); }
    bool isImplicitArguments() const { return test(PND_IMPLICITARGUMENTS); }
    bool isHoistedLetUse() const { return test(PND_LET) && isUsed(); }

    /* True if pn is a parsenode representing a literal constant. */
    bool isLiteral() const {
        return isKind(PNK_NUMBER) ||
               isKind(PNK_STRING) ||
               isKind(PNK_TRUE) ||
               isKind(PNK_FALSE) ||
               isKind(PNK_NULL);





template <typename ParseHandler>
static void
PushStatementPC(ParseContext<ParseHandler> *pc, StmtInfoPC *stmt, StmtType type)
{
    stmt->blockid = pc->blockid();
    PushStatement(pc, stmt, type);
}

template <>
bool
ParseContext<FullParseHandler>::checkLocalsOverflow(TokenStream &ts)
{
    if (vars_.length() + bodyLevelLets_.length() >= LOCALNO_LIMIT) {
        ts.reportError(JSMSG_TOO_MANY_LOCALS);
        return false;
    }
    return true;
}

static void
MarkUsesAsHoistedLet(ParseNode *pn)
{
    MOZ_ASSERT(pn->isDefn());

    Definition *dn = (Definition *)pn;
    ParseNode **pnup = &dn->dn_uses;
    ParseNode *pnu;
    unsigned start = pn->pn_blockid;

    // In ES6, 'let' bindings cannot be accessed until initialized.
    // Distinguish hoisted uses as a different JSOp for easier compilation.
    while ((pnu = *pnup) != nullptr && pnu->pn_blockid >= start) {
        MOZ_ASSERT(pnu->isUsed());
        pnu->pn_dflags |= PND_LET;
        pnup = &pnu->pn_link;
    }
}

// See comment on member function declaration.
template <>
bool
ParseContext<FullParseHandler>::define(TokenStream &ts,
                                       HandlePropertyName name, ParseNode *pn, Definition::Kind kind)
{
    JS_ASSERT(!pn->isUsed());
    JS_ASSERT_IF(pn->isDefn(), pn->isPlaceholder());

    if (kind == Definition::CONST)
        pn->pn_dflags |= PND_CONST;

    Definition *dn = (Definition *)pn;
    switch (kind) {
      case Definition::ARG:
        JS_ASSERT(sc->isFunctionBox());
        dn->setOp((js_CodeSpec[dn->getOp()].format & JOF_SET) ? JSOP_SETARG : JSOP_GETARG);
        dn->pn_blockid = bodyid;
        dn->pn_dflags |= PND_BOUND;
        if (!dn->pn_cookie.set(ts, staticLevel, args_.length()))
            return false;
        if (!args_.append(dn))
            return false;
        if (args_.length() >= ARGNO_LIMIT) {
            ts.reportError(JSMSG_TOO_MANY_FUN_ARGS);
            return false;

        if (!decls_.addUnique(name, dn))
            return false;
        break;

      case Definition::CONST:
      case Definition::VAR:
        if (sc->isFunctionBox()) {
            dn->setOp((js_CodeSpec[dn->getOp()].format & JOF_SET) ? JSOP_SETLOCAL : JSOP_GETLOCAL);
            dn->pn_blockid = bodyid;
            dn->pn_dflags |= PND_BOUND;
            if (!dn->pn_cookie.set(ts, staticLevel, vars_.length()))
                return false;
            if (!vars_.append(dn))
                return false;
            if (!checkLocalsOverflow(ts))
                ts.reportError(JSMSG_TOO_MANY_LOCALS);
                return false;
            }
        }
        if (!decls_.addUnique(name, dn))
            return false;
        break;

      case Definition::LET:
        dn->setOp(JSOP_INITLET);
        dn->pn_dflags |= (PND_LET | PND_BOUND);
        JS_ASSERT(dn->pn_cookie.level() == staticLevel); /* see bindLet */
        if (atBodyLevel()) {
            if (!bodyLevelLets_.append(dn))
                return false;
            if (!checkLocalsOverflow(ts))
                return false;
        }

        // In ES6, lets cannot be accessed until initialized. If the
        // definition has existing uses, they need to be marked so that we
        // emit dead zone checks.
        MarkUsesAsHoistedLet(pn);

        if (!decls_.addShadow(name, dn))
            return false;
        break;

      default:
        MOZ_CRASH("unexpected kind");
    }

    return true;
}

template <>
bool
ParseContext<SyntaxParseHandler>::checkLocalsOverflow(TokenStream &ts)
{
    return true;
}

template <>
bool
ParseContext<SyntaxParseHandler>::define(TokenStream &ts, HandlePropertyName name, Node pn,
                                         Definition::Kind kind)
{
    JS_ASSERT(!decls_.lookupFirst(name));

    if (lexdeps.lookupDefn<SyntaxParseHandler>(name))
        lexdeps->remove(name);


AppendPackedBindings(const ParseContext<ParseHandler> *pc, const DeclVector &vec, Binding *dst)
{
    for (size_t i = 0; i < vec.length(); ++i, ++dst) {
        Definition *dn = vec[i];
        PropertyName *name = dn->name();

        Binding::Kind kind;
        switch (dn->kind()) {
          case Definition::LET:
            // Treat body-level let declarations as var bindings by falling
            // through. The fact that the binding is in fact a let declaration
            // is reflected in the slot. All body-level lets go after the
            // vars.
          case Definition::VAR:
            kind = Binding::VARIABLE;
            break;
          case Definition::CONST:
            kind = Binding::CONSTANT;
            break;
          case Definition::ARG:
            kind = Binding::ARGUMENT;

template <typename ParseHandler>
bool
ParseContext<ParseHandler>::generateFunctionBindings(ExclusiveContext *cx, TokenStream &ts,
                                                     LifoAlloc &alloc,
                                                     InternalHandle<Bindings*> bindings) const
{
    JS_ASSERT(sc->isFunctionBox());
    JS_ASSERT(args_.length() < ARGNO_LIMIT);
    JS_ASSERT(vars_.length() + bodyLevelLets_.length() < LOCALNO_LIMIT);

    /*
     * Avoid pathological edge cases by explicitly limiting the total number of
     * bindings to what will fit in a uint32_t.
     */
    if (UINT32_MAX - args_.length() <= vars_.length() + bodyLevelLets_.length())
        return ts.reportError(JSMSG_TOO_MANY_LOCALS);

    // Fix up the slots of body-level lets to come after the vars now that we
    // know how many vars there are.
    for (size_t i = 0; i < bodyLevelLets_.length(); i++) {
        Definition *dn = bodyLevelLets_[i];
        if (!dn->pn_cookie.set(ts, dn->pn_cookie.level(), vars_.length() + i))
            return false;
    }

    uint32_t count = args_.length() + vars_.length() + bodyLevelLets_.length();
    Binding *packedBindings = alloc.newArrayUninitialized<Binding>(count);
    if (!packedBindings) {
        js_ReportOutOfMemory(cx);
        return false;
    }

    AppendPackedBindings(this, args_, packedBindings);
    AppendPackedBindings(this, vars_, packedBindings + args_.length());
    AppendPackedBindings(this, bodyLevelLets_, packedBindings + args_.length() + vars_.length());

    return Bindings::initWithTemporaryStorage(cx, bindings, args_.length(), vars_.length(),
                                              bodyLevelLets_.length(), blockScopeDepth,
                                              packedBindings);
}

template <typename ParseHandler>
bool
Parser<ParseHandler>::reportHelper(ParseReportKind kind, bool strict, uint32_t offset,
                                   unsigned errorNumber, va_list args)
{
    bool result = false;

        return null();

    return pn;
}

/* See comment for use in Parser::functionDef. */
template <>
bool
Parser<FullParseHandler>::makeDefIntoUse(Definition *dn, ParseNode *pn, JSAtom *atom,
                                         bool *pbodyLevelHoistedUse)
{
    // See comment in addFreeVariablesFromLazyFunction.
    *pbodyLevelHoistedUse = !!dn->dn_uses;

    /* Turn pn into a definition. */
    pc->updateDecl(atom, pn);

    /* Change all uses of dn to be uses of pn. */
    for (ParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
        JS_ASSERT(pnu->isUsed());
        JS_ASSERT(!pnu->isDefn());
        pnu->pn_lexdef = (Definition *) pn;


    struct LetData {
        explicit LetData(ExclusiveContext *cx) : blockObj(cx) {}
        VarContext varContext;
        RootedStaticBlockObject blockObj;
        unsigned   overflow;
    } let;

    void initLet(VarContext varContext, StaticBlockObject *blockObj, unsigned overflow) {
        this->pn = ParseHandler::null();
        this->op = JSOP_INITLET;
        this->binder = Parser<ParseHandler>::bindLet;
        this->let.varContext = varContext;
        this->let.blockObj = blockObj;
        this->let.overflow = overflow;
    }

    void initVarOrConst(JSOp op) {
        this->op = op;
        this->binder = Parser<ParseHandler>::bindVarOrConst;
    }
};

 * Beware: this function is called for functions nested in other functions or
 * global scripts but not for functions compiled through the Function
 * constructor or JSAPI. To always execute code when a function has finished
 * parsing, use Parser::functionBody.
 */
template <>
bool
Parser<FullParseHandler>::leaveFunction(ParseNode *fn, ParseContext<FullParseHandler> *outerpc,
                                        bool bodyLevelHoistedUse, FunctionSyntaxKind kind)
{
    outerpc->blockidGen = pc->blockidGen;

    FunctionBox *funbox = fn->pn_funbox;
    JS_ASSERT(funbox == pc->sc->asFunctionBox());

    /* Propagate unresolved lexical names up to outerpc->lexdeps. */
    if (pc->lexdeps->count()) {

             * when leaving the inner function.
             *
             * The dn == outer_dn case arises with generator expressions
             * (see LegacyCompExprTransplanter::transplant, the PN_CODE/PN_NAME
             * case), and nowhere else, currently.
             */
            if (dn != outer_dn) {
                if (ParseNode *pnu = dn->dn_uses) {
                    // In ES6, 'let' bindings cannot be accessed until
                    // initialized. If we are parsing a function with a
                    // hoisted body-level use, all free variables that get
                    // linked to an outer 'let' binding need to be marked as
                    // needing dead zone checks. e.g.,
                    //
                    // function outer() {
                    //   inner();
                    //   function inner() { use(x); }
                    //   let x;
                    // }
                    //
                    // The use of 'x' inside 'inner' needs to be marked.
                    if (bodyLevelHoistedUse && outer_dn->isLet()) {
                        while (true) {
                            pnu->pn_dflags |= PND_LET;
                            if (!pnu->pn_link)
                                break;
                            pnu = pnu->pn_link;
                        }
                        pnu = dn->dn_uses;
                    }

                    while (true) {
                        pnu->pn_lexdef = outer_dn;
                        if (!pnu->pn_link)
                            break;
                        pnu = pnu->pn_link;
                    }
                    pnu->pn_link = outer_dn->dn_uses;
                    outer_dn->dn_uses = dn->dn_uses;

    InternalHandle<Bindings*> bindings =
        InternalHandle<Bindings*>::fromMarkedLocation(&funbox->bindings);
    return pc->generateFunctionBindings(context, tokenStream, alloc, bindings);
}

template <>
bool
Parser<SyntaxParseHandler>::leaveFunction(Node fn, ParseContext<SyntaxParseHandler> *outerpc,
                                          bool bodyLevelHoistedUse, FunctionSyntaxKind kind)
{
    outerpc->blockidGen = pc->blockidGen;

    FunctionBox *funbox = pc->sc->asFunctionBox();
    return addFreeVariablesFromLazyFunction(funbox->function(), outerpc, bodyLevelHoistedUse);
}

/*
 * defineArg is called for both the arguments of a regular function definition
 * and the arguments specified by the Function constructor.
 *
 * The 'disallowDuplicateArgs' bool indicates whether the use of another
 * feature (destructuring or default arguments) disables duplicate arguments.


    return true;
}

template <>
bool
Parser<FullParseHandler>::checkFunctionDefinition(HandlePropertyName funName,
                                                  ParseNode **pn_, FunctionSyntaxKind kind,
                                                  bool *pbodyProcessed,
                                                  bool *pbodyLevelHoistedUse)
{
    ParseNode *&pn = *pn_;
    *pbodyProcessed = false;
    *pbodyLevelHoistedUse = false;

    /* Function statements add a binding to the enclosing scope. */
    bool bodyLevel = pc->atBodyLevel();

    if (kind == Statement) {
        /*
         * Handle redeclaration and optimize cases where we can statically bind the
         * function (thereby avoiding JSOP_DEFFUN and dynamic name lookup).

                    // remains a definition. But change the function node pn so
                    // that it knows where the argument is located.
                    pn->setOp(JSOP_GETARG);
                    pn->setDefn(true);
                    pn->pn_cookie = dn->pn_cookie;
                    pn->pn_dflags |= PND_BOUND;
                    dn->markAsAssigned();
                } else {
                    if (!makeDefIntoUse(dn, pn, funName, pbodyLevelHoistedUse))
                        return false;
                }
            }
        } else if (bodyLevel) {
            /*
             * If this function was used before it was defined, claim the
             * pre-created definition node for this function that primaryExpr
             * put in pc->lexdeps on first forward reference, and recycle pn.

                fn->pn_pos.end = pn->pn_pos.end;

                fn->pn_body = nullptr;
                fn->pn_cookie.makeFree();

                pc->lexdeps->remove(funName);
                handler.freeTree(pn);
                pn = fn;

                *pbodyLevelHoistedUse = true;
            }

            if (!pc->define(tokenStream, funName, pn, Definition::VAR))
                return false;
        }

        if (bodyLevel) {
            JS_ASSERT(pn->functionIsHoisted());

    if (LazyScript *lazyOuter = handler.lazyOuterFunction()) {
        JSFunction *fun = handler.nextLazyInnerFunction();
        JS_ASSERT(!fun->isLegacyGenerator());
        FunctionBox *funbox = newFunctionBox(pn, fun, pc, Directives(/* strict = */ false),
                                             fun->generatorKind());
        if (!funbox)
            return false;

        if (!addFreeVariablesFromLazyFunction(fun, pc, *pbodyLevelHoistedUse))
            return false;

        // The position passed to tokenStream.advance() is relative to
        // userbuf.base() while LazyScript::{begin,end} offsets are relative to
        // the outermost script source. N.B: userbuf.base() is initialized
        // (in TokenStream()) to begin() - column() so that column numbers in
        // the lazily parsed script are correct.
        uint32_t userbufBase = lazyOuter->begin() - lazyOuter->column();

     outer->setBindingsAccessedDynamically();
   if (inner->hasDebuggerStatement())
     outer->setHasDebuggerStatement();
}

template <typename ParseHandler>
bool
Parser<ParseHandler>::addFreeVariablesFromLazyFunction(JSFunction *fun,
                                                       ParseContext<ParseHandler> *pc,
                                                       bool bodyLevelHoistedUse)
{
    MOZ_ASSERT_IF(bodyLevelHoistedUse, fun->displayAtom() && pc->atBodyLevel());

    // Update any definition nodes in this context according to free variables
    // in a lazily parsed inner function.

    LazyScript *lazy = fun->lazyScript();
    LazyScript::FreeVariable *freeVariables = lazy->freeVariables();
    for (size_t i = 0; i < lazy->numFreeVariables(); i++) {
        JSAtom *atom = freeVariables[i].atom();

        // 'arguments' will be implicitly bound within the inner function.
        if (atom == context->names().arguments)
            continue;

        DefinitionNode dn = pc->decls().lookupFirst(atom);

        if (!dn) {
            dn = getOrCreateLexicalDependency(pc, atom);
            if (!dn)
                return false;
        }

        // In ES6, lets are unaccessible before initialization. If the inner
        // function closes over a placeholder definition, we need to mark the
        // variable as maybe needing a dead zone check when we emit bytecode.
        //
        // Note that body-level function declaration statements are always
        // hoisted to the top, so all accesses to free let variables need the
        // dead zone check.
        if (handler.isPlaceholderDefinition(dn) || bodyLevelHoistedUse)
            freeVariables[i].setIsHoistedUse();

        /* Mark the outer dn as escaping. */
        handler.setFlag(handler.getDefinitionNode(dn), PND_CLOSED);
    }

    PropagateTransitiveParseFlags(lazy, pc->sc);
    return true;
}

template <>
bool
Parser<SyntaxParseHandler>::checkFunctionDefinition(HandlePropertyName funName,
                                                    Node *pn, FunctionSyntaxKind kind,
                                                    bool *pbodyProcessed,
                                                    bool *pbodyLevelHoistedUse)
{
    *pbodyProcessed = false;
    *pbodyLevelHoistedUse = false;

    /* Function statements add a binding to the enclosing scope. */
    bool bodyLevel = pc->atBodyLevel();

    if (kind == Statement) {
        /*
         * Handle redeclaration and optimize cases where we can statically bind the
         * function (thereby avoiding JSOP_DEFFUN and dynamic name lookup).

                if (!AtomToPrintableString(context, funName, &name) ||
                    !report(ParseError, false, null(), JSMSG_REDECLARED_VAR,
                            Definition::kindString(dn), name.ptr()))
                {
                    return false;
                }
            }
        } else if (bodyLevel) {
            if (pc->lexdeps.lookupDefn<SyntaxParseHandler>(funName)) {
                *pbodyLevelHoistedUse = true;
                pc->lexdeps->remove(funName);
            }

            if (!pc->define(tokenStream, funName, *pn, Definition::VAR))
                return false;
        }

        if (!bodyLevel && funName == context->names().arguments)
            pc->sc->setBindingsAccessedDynamically();
    }

    JS_ASSERT_IF(kind == Statement, funName);

    /* Make a TOK_FUNCTION node. */
    Node pn = handler.newFunctionDefinition();
    if (!pn)
        return null();

    bool bodyProcessed;
    bool bodyLevelHoistedUse;
    if (!checkFunctionDefinition(funName, &pn, kind, &bodyProcessed, &bodyLevelHoistedUse))
        return null();

    if (bodyProcessed)
        return pn;

    RootedObject proto(context);
    if (generatorKind == StarGenerator) {
        // If we are off the main thread, the generator meta-objects have

    // Speculatively parse using the directives of the parent parsing context.
    // If a directive is encountered (e.g., "use strict") that changes how the
    // function should have been parsed, we backup and reparse with the new set
    // of directives.
    Directives directives(pc);
    Directives newDirectives = directives;

    while (true) {
        if (functionArgsAndBody(pn, fun, type, kind, generatorKind, directives, &newDirectives,
                                bodyLevelHoistedUse))
            break;
        if (tokenStream.hadError() || directives == newDirectives)
            return null();

        // Assignment must be monotonic to prevent reparsing iloops
        JS_ASSERT_IF(directives.strict(), newDirectives.strict());
        JS_ASSERT_IF(directives.asmJS(), newDirectives.asmJS());
        directives = newDirectives;


    RootedFunction fun(context, funbox->function());
    LazyScript *lazy = LazyScript::CreateRaw(context, fun, numFreeVariables, numInnerFunctions,
                                             versionNumber(), funbox->bufStart, funbox->bufEnd,
                                             funbox->startLine, funbox->startColumn);
    if (!lazy)
        return false;

    LazyScript::FreeVariable *freeVariables = lazy->freeVariables();
    size_t i = 0;
    for (AtomDefnRange r = pc->lexdeps->all(); !r.empty(); r.popFront())
        freeVariables[i++] = LazyScript::FreeVariable(r.front().key());
    JS_ASSERT(i == numFreeVariables);

    HeapPtrFunction *innerFunctions = lazy->innerFunctions();
    for (size_t i = 0; i < numInnerFunctions; i++)
        innerFunctions[i].init(pc->innerFunctions[i]);

    if (pc->sc->strict)
        lazy->setStrict();

}

template <>
bool
Parser<FullParseHandler>::functionArgsAndBody(ParseNode *pn, HandleFunction fun,
                                              FunctionType type, FunctionSyntaxKind kind,
                                              GeneratorKind generatorKind,
                                              Directives inheritedDirectives,
                                              Directives *newDirectives,
                                              bool bodyLevelHoistedUse)
{
    ParseContext<FullParseHandler> *outerpc = pc;

    // Create box for fun->object early to protect against last-ditch GC.
    FunctionBox *funbox = newFunctionBox(pn, fun, pc, inheritedDirectives, generatorKind);
    if (!funbox)
        return false;


            // Move the syntax parser to the current position in the stream.
            TokenStream::Position position(keepAtoms);
            tokenStream.tell(&position);
            if (!parser->tokenStream.seek(position, tokenStream))
                return false;

            ParseContext<SyntaxParseHandler> funpc(parser, outerpc, SyntaxParseHandler::null(), funbox,
                                                   newDirectives, outerpc->staticLevel + 1,
                                                   outerpc->blockidGen, /* blockScopeDepth = */ 0);
                                                   /* blockScopeDepth = */ 0);
            if (!funpc.init(tokenStream))
                return false;

            if (!parser->functionArgsAndBodyGeneric(SyntaxParseHandler::NodeGeneric,
                                                    fun, type, kind, newDirectives))
            {
                if (parser->hadAbortedSyntaxParse()) {
                    // Try again with a full parse.

            parser->tokenStream.tell(&position);
            if (!tokenStream.seek(position, parser->tokenStream))
                return false;

            // Update the end position of the parse node.
            pn->pn_pos.end = tokenStream.currentToken().pos.end;
        }

        if (!addFreeVariablesFromLazyFunction(fun, pc, bodyLevelHoistedUse))
            return false;

        pn->pn_blockid = outerpc->blockid();
        PropagateTransitiveParseFlags(funbox, outerpc->sc);
        return true;
    } while (false);

    // Continue doing a full parse for this inner function.

                                         outerpc->staticLevel + 1, outerpc->blockidGen,
                                         /* blockScopeDepth = */ 0);
    if (!funpc.init(tokenStream))
        return false;

    if (!functionArgsAndBodyGeneric(pn, fun, type, kind, newDirectives))
        return false;

    if (!leaveFunction(pn, outerpc, bodyLevelHoistedUse, kind))
        return false;

    pn->pn_blockid = outerpc->blockid();

    /*
     * Fruit of the poisonous tree: if a closure contains a dynamic name access
     * (eval, with, etc), we consider the parent to do the same. The reason is
     * that the deoptimizing effects of dynamic name access apply equally to

}

template <>
bool
Parser<SyntaxParseHandler>::functionArgsAndBody(Node pn, HandleFunction fun,
                                                FunctionType type, FunctionSyntaxKind kind,
                                                GeneratorKind generatorKind,
                                                Directives inheritedDirectives,
                                                Directives *newDirectives,
                                                bool bodyLevelHoistedUse)
{
    ParseContext<SyntaxParseHandler> *outerpc = pc;

    // Create box for fun->object early to protect against last-ditch GC.
    FunctionBox *funbox = newFunctionBox(pn, fun, pc, inheritedDirectives, generatorKind);
    if (!funbox)
        return false;


                                           outerpc->staticLevel + 1, outerpc->blockidGen,
                                           /* blockScopeDepth = */ 0);
    if (!funpc.init(tokenStream))
        return false;

    if (!functionArgsAndBodyGeneric(pn, fun, type, kind, newDirectives))
        return false;

    if (!leaveFunction(pn, outerpc, bodyLevelHoistedUse, kind))
        return false;

    // This is a lazy function inner to another lazy function. Remember the
    // inner function so that if the outer function is eventually parsed we do
    // not need any further parsing or processing of the inner function.
    JS_ASSERT(fun->lazyScript());
    return outerpc->innerFunctions.append(fun);
}

                                  HandlePropertyName name, Parser<FullParseHandler> *parser)
{
    ParseContext<FullParseHandler> *pc = parser->pc;
    ParseNode *pn = data->pn;
    if (!parser->checkStrictBinding(name, pn))
        return false;

    ExclusiveContext *cx = parser->context;

    Rooted<StaticBlockObject *> blockObj(cx, data->let.blockObj);

    unsigned index;
    if (blockObj) {
        index = blockObj->numVariables();
        if (index >= StaticBlockObject::LOCAL_INDEX_LIMIT) {
            parser->report(ParseError, false, pn, data->let.overflow);
            return false;
        }
    } else {
        // If we don't have a block object, we are parsing a body-level let,
        // in which case we use a bogus index. See comment block below in
        // setting the pn_cookie for explanation on how it gets adjusted.
        index = 0;
    }

    // For block-level lets, assign block-local index to pn->pn_cookie right
    // away, encoding it as an upvar cookie whose skip tells the current
    // static level. The emitter will adjust the node's slot based on its
    // stack depth model -- and, for global and eval code,
    // js::frontend::CompileScript will adjust the slot again to include
    // script->nfixed and body-level lets.
    //
    // For body-level lets, the index is bogus at this point and is adjusted
    // when creating Bindings. See ParseContext::generateFunctionBindings.
    if (!pn->pn_cookie.set(parser->tokenStream, pc->staticLevel, index))
        return false;

    /*
     * For bindings that are hoisted to the beginning of the block/function,
     * define() right now. Otherwise, delay define until PushLetScope.
     */
    if (data->let.varContext == HoistVars) {
        JS_ASSERT(!pc->atBodyLevel());
        Definition *dn = pc->decls().lookupFirst(name);
        if (dn && dn->pn_blockid == pc->blockid())
            return parser->reportRedeclaration(pn, dn->isConst(), name);
        if (!pc->define(parser->tokenStream, name, pn, Definition::LET))
            return false;
    }

    if (blockObj) {
        bool redeclared;
        RootedId id(cx, NameToId(name));
        RootedShape shape(cx, StaticBlockObject::addVar(cx, blockObj, id, index, &redeclared));
        if (!shape) {
            if (redeclared)
                parser->reportRedeclaration(pn, false, name);
            return false;
        }

        /* Store pn in the static block object. */
        blockObj->setDefinitionParseNode(index, reinterpret_cast<Definition *>(pn));
    } else {
        // Body-level lets are hoisted and need to have been defined via
        // pc->define above.
        MOZ_ASSERT(data->let.varContext == HoistVars);
        MOZ_ASSERT(pc->decls().lookupFirst(name));
    }

    /* Store pn in the static block object. */
    blockObj->setDefinitionParseNode(index, reinterpret_cast<Definition *>(pn));
    return true;
}

template <>
/* static */ bool
Parser<SyntaxParseHandler>::bindLet(BindData<SyntaxParseHandler> *data,
                                    HandlePropertyName name, Parser<SyntaxParseHandler> *parser)
{

         */
        dn = getOrCreateLexicalDependency(pc, name);
        if (!dn)
            return false;
    }

    handler.linkUseToDef(pn, dn);

    if (stmt) {
        if (stmt->type == STMT_WITH) {
            handler.setFlag(pn, PND_DEOPTIMIZED);
        } else if (stmt->type == STMT_SWITCH && stmt->isBlockScope) {
            // See comments above StmtInfoPC and switchStatement for how
            // firstDominatingLetInCase is computed.
            MOZ_ASSERT(stmt->firstDominatingLetInCase <= stmt->staticBlock().numVariables());
            handler.markMaybeUninitializedLetUseInSwitch(pn, dn, stmt->firstDominatingLetInCase);
        }
    }

    return true;
}

template <>
bool
Parser<FullParseHandler>::bindDestructuringVar(BindData<FullParseHandler> *data, ParseNode *pn)
{

    data->pn = pn;
    if (!data->binder(data, name, this))
        return false;

    /*
     * Select the appropriate name-setting opcode, respecting eager selection
     * done by the data->binder function.
     */
    if (data->op == JSOP_INITLET)
        pn->setOp(JSOP_INITLET);
    else if (pn->pn_dflags & PND_BOUND)
        pn->setOp(JSOP_SETLOCAL);
    else if (data->op == JSOP_DEFCONST)
        pn->setOp(JSOP_SETCONST);
    else
        pn->setOp(JSOP_SETNAME);

    if (data->op == JSOP_DEFCONST)
        pn->pn_dflags |= PND_CONST;

    JS_ASSERT(kind == PNK_VAR || kind == PNK_CONST || kind == PNK_LET || kind == PNK_CALL);

    /*
     * The simple flag is set if the declaration has the form 'var x', with
     * only one variable declared and no initializer expression.
     */
    JS_ASSERT_IF(psimple, *psimple);

    JSOp op = kind == PNK_LET ? JSOP_NOP : kind == PNK_VAR ? JSOP_DEFVAR : JSOP_DEFCONST;

    Node pn = handler.newList(kind, null(), op);
    if (!pn)
        return null();

    /*
     * SpiderMonkey const is really "write once per initialization evaluation"
     * var, whereas let is block scoped. ES-Harmony wants block-scoped const so
     * this code will change soon.
     */
    BindData<ParseHandler> data(context);
    if (kind == PNK_LET)
        data.initLet(varContext, blockObj, JSMSG_TOO_MANY_LOCALS);
    else
        data.initVarOrConst(op);

    bool first = true;
    Node pn2;
    do {
        if (psimple && !first)
            *psimple = false;

                *psimple = false;

            pc->inDeclDestructuring = true;
            pn2 = primaryExpr(tt);
            pc->inDeclDestructuring = false;
            if (!pn2)
                return null();

            if (!checkDestructuring(&data, pn2))
                return null();
            bool ignored;
            bool parsingForInOrOfInit = pc->parsingForInit && matchInOrOf(&ignored);

            // See comment below for bindBeforeInitializer in the code that
            // handles the non-destructuring case.
            bool bindBeforeInitializer = kind != PNK_LET || parsingForInOrOfInit;
            if (bindBeforeInitializer && !checkDestructuring(&data, pn2))
                return null();

            if (parsingForInOrOfInit) {
                tokenStream.ungetToken();
                handler.addList(pn, pn2);
                continue;
            }

            MUST_MATCH_TOKEN(TOK_ASSIGN, JSMSG_BAD_DESTRUCT_DECL);

            Node init = assignExpr();
            if (!init)
                return null();

            if (!bindBeforeInitializer && !checkDestructuring(&data, pn2))
                return null();

            pn2 = handler.newBinaryOrAppend(PNK_ASSIGN, pn2, init, pc);
            if (!pn2)
                return null();
            handler.addList(pn, pn2);
            continue;
        }

        if (tt != TOK_NAME) {


        RootedPropertyName name(context, tokenStream.currentName());
        pn2 = newBindingNode(name, kind == PNK_VAR || kind == PNK_CONST, varContext);
        if (!pn2)
            return null();
        if (data.op == JSOP_DEFCONST)
            handler.setFlag(pn2, PND_CONST);
        data.pn = pn2;

            return null();
        handler.addList(pn, pn2);

        if (tokenStream.matchToken(TOK_ASSIGN)) {
            if (psimple)
                *psimple = false;

            // Per ES6, 'let' declarations may not be accessed until
            // initialized. So a declaration of the form |let x = x| results in a
            // ReferenceError, as the 'x' on the RHS is accessing the let binding
            // before it is initialized.
            //
            // If we are not parsing a let declaration, bind the name
            // now. Otherwise we must wait until after parsing the initializing
            // assignment.
            //
            // Optimize the common case of recursive function calls, e.g.,
            //
            //   let f = function (...) { f(...); };
            //
            // by binding early, since any uses of the binding inside the body of
            // the function will be after initialization.
            TokenKind nextToken = tokenStream.peekToken(TokenStream::Operand);
            bool bindBeforeInitializer = kind != PNK_LET || nextToken == TOK_FUNCTION;
            if (bindBeforeInitializer && !data.binder(&data, name, this))
                return null();

            Node init = assignExpr();
            if (!init)
                return null();

            if (!bindBeforeInitializer && !data.binder(&data, name, this))
                return null();

            if (!handler.finishInitializerAssignment(pn2, init, data.op))
                return null();
        } else {
            if (!data.binder(&data, name, this))
                return null();
        }


    } while (tokenStream.matchToken(TOK_COMMA));

    return pn;
}

template <>
ParseNode *
Parser<FullParseHandler>::letDeclaration()

                 * before the global object in the overall chain.  This extra
                 * object is present in the scope chain for all code in that
                 * global, including self-hosted code.  But self-hosted code
                 * must be usable against *any* global object, including ones
                 * with other let variables -- variables possibly placed in
                 * conflicting slots.  Forbid top-level let declarations to
                 * prevent such conflicts from ever occurring.
                 */
                bool globalLet = !pc->sc->isFunctionBox() && stmt == pc->topScopeStmt;
                if (options().selfHostingMode && globalLet) {
                    stmt == pc->topScopeStmt)
                {
                    report(ParseError, false, null(), JSMSG_SELFHOSTED_TOP_LEVEL_LET);
                    return null();
                }

                /*
                 * Parse body-level lets without a new block object. ES6 specs
                 * that an execution environment's initial lexical environment
                 * is the VariableEnvironment, i.e., body-level lets are in
                 * the same environment record as vars.
                 *
                 * However, they cannot be parsed exactly as vars, as ES6
                 * requires that uninitialized lets throw ReferenceError on use.
                 *
                 * See 8.1.1.1.6 and the note in 13.2.1.
                 *
                 * FIXME global-level lets are still considered vars until
                 * other bugs are fixed.
                 */
                pn = variables(globalLet ? PNK_VAR : PNK_LET);
                if (!pn)
                    return null();
                pn->pn_xflags |= PNX_POPVAR;
                break;
            }

            /*
             * Some obvious assertions here, but they may help clarify the

            if (tt == TOK_ERROR)
                return null();
            Node stmt = statement();
            if (!stmt)
                return null();
            handler.addList(body, stmt);
        }

        // In ES6, 'let' bindings canot be accessed until initialized. If
        // there was a 'let' declaration in the case we just parsed, remember
        // the slot starting at which new 'let' bindings will be
        // assigned. Since 'let' bindings from previous cases will not
        // dominate uses in the current case, any such uses will require a
        // dead zone check.
        if (pc->blockNode != caseList)
            stmtInfo.firstDominatingLetInCase = stmtInfo.staticBlock().numVariables();

        Node casepn = handler.newCaseOrDefault(caseBegin, caseExpr, body);
        if (!casepn)
            return null();
        handler.addList(caseList, casepn);
    }

    /*
     * Handle the case where there was a let declaration in any case in

             */
            MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_CATCH);

            /*
             * Contrary to ECMA Ed. 3, the catch variable is lexically
             * scoped, not a property of a new Object instance.  This is
             * an intentional change that anticipates ECMA Ed. 4.
             */
            data.initLet(HoistVars, &pc->staticScope->template as<StaticBlockObject>(),
                         JSMSG_TOO_MANY_CATCH_VARS);
            JS_ASSERT(data.let.blockObj);

            tt = tokenStream.getToken();
            Node catchName;
            switch (tt) {
              case TOK_LB:
              case TOK_LC:

    LegacyCompExprTransplanter transplanter(bodyStmt, this, outerpc, comprehensionKind, adjust);
    if (!transplanter.init())
        return null();

    if (!transplanter.transplant(bodyStmt))
        return null();

    JS_ASSERT(pc->staticScope && pc->staticScope == pn->pn_objbox->object);
    data.initLet(HoistVars, &pc->staticScope->as<StaticBlockObject>(), JSMSG_ARRAY_INIT_TOO_BIG);

    do {
        /*
         * FOR node is binary, left is loop control and right is body.  Use
         * index to count each block-local let-variable on the left-hand side
         * of the in/of.
         */
        pn2 = BinaryNode::create(PNK_FOR, &handler);

            break;

          default:;
        }

        /*
         * Synthesize a declaration. Every definition must appear in the parse
         * tree in order for ComprehensionTranslator to work.
         *
         * These are lets to tell the bytecode emitter to emit initialization
         * code for the temporal dead zone.
         */
        ParseNode *lets = ListNode::create(PNK_LET, &handler);
        if (!lets)
            return null();
        lets->setOp(JSOP_NOP);
        lets->pn_pos = pn3->pn_pos;
        lets->makeEmpty();
        lets->append(pn3);
        lets->pn_xflags |= PNX_POPVAR;

        /* Definitions can't be passed directly to EmitAssignment as lhs. */
        pn3 = cloneLeftHandSide(pn3);
        if (!pn3)
            return null();

        pn2->pn_left = handler.newTernary(headKind, lets, pn3, pn4);
        if (!pn2->pn_left)
            return null();
        *pnp = pn2;
        pnp = &pn2->pn_right;
    } while (tokenStream.matchToken(TOK_FOR));

    if (tokenStream.matchToken(TOK_IF)) {
        pn2 = TernaryNode::create(PNK_IF, &handler);


    // Note that if we ever start syntax-parsing generators, we will also
    // need to propagate the closed-over variable set to the inner
    // lazyscript, as in finishFunctionDefinition.
    handler.setFunctionBody(genfn, body);

    PropagateTransitiveParseFlags(genFunbox, outerpc->sc);

    if (!leaveFunction(genfn, outerpc, /* bodyLevelHoistedUse = */ false))
        return null();

    return genfn;
}

#if JS_HAS_GENERATOR_EXPRS

/*


    TokenPos headPos(begin, pos().end);

    StmtInfoPC stmtInfo(context);
    BindData<ParseHandler> data(context);
    RootedStaticBlockObject blockObj(context, StaticBlockObject::create(context));
    if (!blockObj)
        return null();
    data.initLet(DontHoistVars, blockObj, JSMSG_TOO_MANY_LOCALS);
    Node lhs = newName(name);
    if (!lhs)
        return null();
    Node decls = handler.newList(PNK_LET, lhs, JSOP_NOP);
    if (!decls)
        return null();
    data.pn = lhs;
    if (!data.binder(&data, name, this))






struct StmtInfoPC : public StmtInfoBase {
    StmtInfoPC      *down;          /* info for enclosing statement */
    StmtInfoPC      *downScope;     /* next enclosing lexical scope */

    uint32_t        blockid;        /* for simplified dominance computation */
    uint32_t        innerBlockScopeDepth; /* maximum depth of nested block scopes, in slots */

    // 'let' declarations inside switches are tricky because the block id
    // doesn't convey dominance information. Record what index the current
    // case's 'let' declarations start at so we may generate dead zone checks
    // for other cases' declarations.
    //
    // Only valid if type is STMT_SWITCH.
    uint16_t        firstDominatingLetInCase;

    explicit StmtInfoPC(ExclusiveContext *cx)
      : StmtInfoBase(cx),
        innerBlockScopeDepth(0),
        firstDominatingLetInCase(0)
    {}
};

typedef HashSet<JSAtom *> FuncStmtSet;
class SharedContext;

typedef Vector<Definition *, 16> DeclVector;

struct GenericParseContext


    bool isArrowFunction() const {
        return sc->isFunctionBox() && sc->asFunctionBox()->function()->isArrow();
    }

    uint32_t        blockScopeDepth; /* maximum depth of nested block scopes, in slots */
    Node            blockNode;      /* parse node for a block with let declarations
                                       (block with its own lexical scope)  */

  private:
    AtomDecls<ParseHandler> decls_; /* function, const, and var declarations */
    DeclVector      args_;          /* argument definitions */
    DeclVector      vars_;          /* var/const definitions */
    DeclVector      bodyLevelLets_; /* let definitions at body-level */

    bool checkLocalsOverflow(TokenStream &ts);

  public:
    const AtomDecls<ParseHandler> &decls() const {
        return decls_;
    }

    uint32_t numArgs() const {
        JS_ASSERT(sc->isFunctionBox());

        maybeFunction(maybeFunction),
        staticLevel(staticLevel),
        lastYieldOffset(NoYieldOffset),
        blockScopeDepth(blockScopeDepth),
        blockNode(ParseHandler::null()),
        decls_(prs->context, prs->alloc),
        args_(prs->context),
        vars_(prs->context),
        bodyLevelLets_(prs->context),
        parserPC(&prs->pc),
        oldpc(prs->pc),
        lexdeps(prs->context),
        funcStmts(nullptr),
        innerFunctions(prs->context),
        newDirectives(newDirectives),
        inDeclDestructuring(false)
    {

     */
    bool functionArguments(FunctionSyntaxKind kind, Node *list, Node funcpn, bool *hasRest);

    Node functionDef(HandlePropertyName name, const TokenStream::Position &start,
                     FunctionType type, FunctionSyntaxKind kind, GeneratorKind generatorKind);
    bool functionArgsAndBody(Node pn, HandleFunction fun,
                             FunctionType type, FunctionSyntaxKind kind,
                             GeneratorKind generatorKind,
                             Directives inheritedDirectives, Directives *newDirectives,
                             bool bodyLevelHoistedUse);

    Node unaryOpExpr(ParseNodeKind kind, JSOp op, uint32_t begin);

    Node condition();

    Node generatorComprehensionLambda(GeneratorKind comprehensionKind, unsigned begin,
                                      Node innerStmt);


        KeyedDestructuringAssignment,
        IncDecAssignment
    };

    bool checkAndMarkAsAssignmentLhs(Node pn, AssignmentFlavor flavor);
    bool matchInOrOf(bool *isForOfp);

    bool checkFunctionArguments();
    bool makeDefIntoUse(Definition *dn, Node pn, JSAtom *atom, bool *pbodyLevelHoistedUse);
    bool checkFunctionDefinition(HandlePropertyName funName, Node *pn, FunctionSyntaxKind kind,
                                 bool *pbodyProcessed, bool *pbodyLevelHoistedUse);
    bool finishFunctionDefinition(Node pn, FunctionBox *funbox, Node prelude, Node body);
    bool addFreeVariablesFromLazyFunction(JSFunction *fun, ParseContext<ParseHandler> *pc,
                                          bool bodyLevelHoistedUse);

    bool isValidForStatementLHS(Node pn1, JSVersion version, bool forDecl, bool forEach,
                                ParseNodeKind headKind);
    bool checkAndMarkAsIncOperand(Node kid, TokenKind tt, bool preorder);
    bool checkStrictAssignment(Node lhs, AssignmentFlavor flavor);
    bool checkStrictBinding(PropertyName *name, Node pn);
    bool defineArg(Node funcpn, HandlePropertyName name,
                   bool disallowDuplicateArgs = false, Node *duplicatedArg = nullptr);


    static Node null() { return ParseHandler::null(); }

    bool reportRedeclaration(Node pn, bool isConst, HandlePropertyName name);
    bool reportBadReturn(Node pn, ParseReportKind kind, unsigned errnum, unsigned anonerrnum);
    DefinitionNode getOrCreateLexicalDependency(ParseContext<ParseHandler> *pc, JSAtom *atom);

    bool leaveFunction(Node fn, ParseContext<ParseHandler> *outerpc,
                       bool bodyLevelHoistedUse, FunctionSyntaxKind kind = Expression);

    TokenPos pos() const { return tokenStream.currentToken().pos; }

    bool asmJS(Node list);

    friend class LegacyCompExprTransplanter;
    friend struct BindData<ParseHandler>;
};





        }
        return nullptr;
    }

    Node makeAssignment(Node pn, Node rhs) { return NodeGeneric; }

    static Node getDefinitionNode(DefinitionNode dn) { return NodeGeneric; }
    static Definition::Kind getDefinitionKind(DefinitionNode dn) { return dn; }
    static bool isPlaceholderDefinition(DefinitionNode dn) { return dn == Definition::PLACEHOLDER; }
    void linkUseToDef(Node pn, DefinitionNode dn) {}
    DefinitionNode resolve(DefinitionNode dn) { return dn; }
    void deoptimizeUsesWithin(DefinitionNode dn, const TokenPos &pos) {}
    bool dependencyCovered(Node pn, unsigned blockid, bool functionScope) {
        // Only resolve lexical dependencies in cases where a definition covers
        // the entire function. Not enough information is kept to compare the
        // dependency location with blockid.
        return functionScope;
    }
    void markMaybeUninitializedLetUseInSwitch(Node pn, DefinitionNode dn,
                                              uint16_t firstDominatingLetSlot) {}

    static uintptr_t definitionToBits(DefinitionNode dn) {
        // Use a shift, as DefinitionList tags the lower bit of its associated union.
        return uintptr_t(dn << 1);
    }
    static DefinitionNode definitionFromBits(uintptr_t bits) {
        return (DefinitionNode) (bits >> 1);
    }





    // close here
    assertEq(a(), 52);
    assertEq(b(), 63);
    assertEq(c(), 54);
    assertEq(d(), 65);
  }

  var a, b = ()=>63;
  var c, d = ()=>65;

  // after var declarations, before function declarations
  assertEq(a(), 52);
  assertEq(b(), 63);
  assertEq(c(), 54);
  assertEq(d(), 65);

  function h() {





function f3(a, b, c, d) {
  // before var/function declarations
  assertEq(a(), 52);
  assertEq(b(), 53);
  assertEq(c(), 54);
  assertEq(d(), 55);

  var a, b = ()=>63;
  var c, d = ()=>65;

  // after var declarations, before function declarations
  assertEq(a(), 52);
  assertEq(b(), 63);
  assertEq(c(), 54);
  assertEq(d(), 65);

  function a() {





    var expect = result;
    if (got !== expect) {
        print("GOT:" + got);
        print("EXPECT: " + expect);
        assertEq(got, expect);
    }
}

function isParseError(str)
{
    var caught = false;
    try {
        new Function(str);
    } catch(e) {
        assertEq(String(e).indexOf('TypeError') == 0 || String(e).indexOf('SyntaxError') == 0, true);
        caught = true;
    }
    assertEq(caught, true);
}

function isReferenceError(str)
{
    var caught = false;
    try {
        (new Function(str))();
    } catch(e) {
        assertEq(String(e).indexOf('ReferenceError') == 0, true);
        caught = true;
    }
    assertEq(caught, true);
}

// let expr
test('return let (y) x;');
test('return let (x) "" + x;', 'unicorns', 'undefined');
test('return let (y = x) (y++, "" + y);', 'unicorns', 'NaN');
test('return let (y = 1) (y = x, y);');
test('return let ([] = x) x;');
test('return let (x = {a: x}) x.a;');
test('return let ({a: x} = {a: x}) x;');

test('return let ([] = [[]] = {}) x;');
test('return let (y = x) function () {return eval("y");}();');
test('return eval("let (y = x) y");');
test('return let (y = x) (eval("var y = 2"), y);', 'ponies', 2);
test('"use strict";return let (y = x) (eval("var y = 2"), y);');
test('this.y = x;return let (y = 1) this.eval("y");');
test('try {let (x = x) eval("throw x");} catch (e) {return e;}');
test('try {return let (x = eval("throw x")) x;} catch (e) {return e;}');
isParseError('let (x = 1, x = 2) x');
isParseError('let ([x, y] = a, {a:x} = b) x');
isParseError('let ([x, y, x] = a) x');
isParseError('let ([x, [y, [x]]] = a) x');
isParseError('let (x = function() { return x}) x()return x;');
isParseError('(let (x = function() { return x}) x())return x;');

// let block
test('let (y) {return x;}');
test('let (y = x) {y++;return "" + y;}', 'unicorns', 'NaN');
test('let (y = 1) {y = x;return y;}');
test('let (x) {return "" + x;}', 'unicorns', 'undefined');
test('let ([] = x) {return x;}');
test('let (x) {}return x;');

test('let (y = x[1]) {let (x = x[0]) {try {let (y = "unicorns") {throw y;}} catch (e) {return x + y;}}}', ['pon','ies']);
test('let (x = x) {try {let (x = "unicorns") eval("throw x");} catch (e) {return x;}}');
test('let ([] = [[]] = {}) {return x;}');
test('let (y = x) {return function () {return eval("y");}();}');
test('return eval("let (y = x) {y;}");');
test('let (y = x) {eval("var y = 2");return y;}', 'ponies', 2);
test('"use strict";let (y = x) {eval("var y = 2");return y;}');
test('this.y = x;let (y = 1) {return this.eval("y");}');
isParseError('let (x = 1, x = 2) {x}');
isParseError('let ([x, y] = a, {a:x} = b) {x}');
isParseError('let ([x, y, x] = a) {x}');
isParseError('let ([x, [y, [x]]] = a) {x}');

// var declarations
test('var y;return x;');
test('var y = x;return x;');
test('var [] = x;return x;');
test('var [, ] = x;return x;');
test('var [, , , , ] = x;return x;');
test('var [[]] = x;return x;');

test('if (x) {var y = x;return x;}');
test('if (x) {y = x;var y = y;return y;}');
test('if (x) {var z = y;var [y] = x;z += y;}return z;', ['-'], 'undefined-');

// let declaration in context
test('if (x) {let y;return x;}');
test('if (x) {let x;return "" + x;}', 'unicorns', 'undefined');
test('if (x) {let y = x;return x;}');
test('if (x) {y = x;let y = y;return y;}');
test('if (x) {var z = y;let [y] = x;z += y;}return z;', ['-'], 'undefined-');
test('if (x) {let y = x;return x;}');
test('if (x) {let [] = x;return x;}');
test('if (x) {let [, ] = x;return x;}');
test('if (x) {let [, , , , ] = x;return x;}');
test('if (x) {let [[]] = x;return x;}');
test('if (x) {let [[[[[[[[[[[[[]]]]]]]]]]]]] = x;return x;}');
test('if (x) {let [[], []] = x;return x;}');
test('if (x) {let [[[[]]], [], , [], [[]]] = x;return x;}');
test('if (x) {let {x: []} = x;return x;}');
test('if (x) {let {x: [], y: {x: []}} = x;return "ponies";}', {y:{}});
test('if (x) {let {x: []} = x, [{x: []}] = x;return "ponies";}');
test('if (x) {let x = x;return "" + x;}', 'unicorns', 'undefined');
test('if (x) {let y = y;return "" + y;}', 'unicorns', 'undefined');
test('if (x) {let x = eval("x");return "" + x;}', 'unicorns', 'undefined');
test('if (x) {let y = (let (x = x + 1) x) + 1;return y;}', 1, 3);
test('if (x) {let y = (let (x = eval("x") + 1) eval("x")) + 1;return eval("y");}', 1, 3);
test('if (x) {let X = x + 1, y = x;return y;}');
test('if (x) {let X = x + 1, [] = X, [[, , ]] = X, y = x;return y;}');
test('if (x) {let [{a: X}] = x, [, {b: Y}] = x;var XX = X + 1, YY = Y + 2;return XX + YY;}', [{a:"p"},{b:"p"}], "p1p2");
test('if (x) {let [[a, [b, c]]] = [[x, []]];return a;}');
test('if (x) {let [X] = [x];return X;}');
test('if (x) {let [y] = [x];return y;}');

test('x.foo;if (x) {x.bar;let y = x;return y;}');
test('if (x) {let y = x;return function () {return eval("y");}();}');
test('return eval("let y = x; y");');
test('if (x) {let y = x;eval("var y = 2");return y;}', 'ponies', 2);
test('"use strict";if (x) {let y = x;eval("var y = 2");return y;}');
test('"use strict";if (x) {let y = x;eval("let y = 2");return y;}');
test('"use strict";if (x) {let y = 1;return eval("let y = x;y;");}');
test('this.y = x;if (x) {let y = 1;return this.eval("y");}');
isParseError('if (x) {let (x = 1, x = 2) {x}}');
isParseError('if (x) {let ([x, y] = a, {a:x} = b) {x}}');
isParseError('if (x) {let ([x, y, x] = a) {x}}');
isParseError('if (x) {let ([x, [y, [x]]] = a) {x}}');
isParseError('let ([x, y] = x) {let x;}');

// for(;;)
test('for (;;) {return x;}');
test('for (let y = 1;;) {return x;}');
test('for (let y = 1;; ++y) {return x;}');
test('for (let y = 1; ++y;) {return x;}');
test('for (let (x = 1) x; x != 1; ++x) {return x;}');
test('for (let [, {a: [], b: []}] = x, [] = x; x;) {return x;}');

test('for (let y = x;;) {let x;return y;}');
test('for (let y = x;;) {let y;return x;}');
test('for (let y;;) {let y;return x;}');
test('for (let a = x;;) {let c = x, d = x;return c;}');
test('for (let [a, b] = x;;) {let c = x, d = x;return c;}');
test('for (let [] = [[]] = {};;) {return x;}');
test('for (let [a] = (1, [x]);;) {return a;}');
test('for (let [a] = (1, x, 1, x);;) {return a;}', ['ponies']);
isParseError('for (let x = 1, x = 2;;) {}');
isParseError('for (let [x, y] = a, {a:x} = b;;) {}');
isParseError('for (let [x, y, x] = a;;) {}');
isParseError('for (let [x, [y, [x]]] = a;;) {}');

// for(in)
test('for (let i in x) {return x;}');
test('for (let i in x) {let y;return x;}');
test('for each (let [a, b] in x) {let y;return x;}');
test('for (let i in x) {let (i = x) {return i;}}');
test('for (let i in x) {let i = x;return i;}');
test('for each (let [x, y] in x) {return x + y;}', [['ponies', '']]);

test('for (let i in x) {break;}return eval("x");');
test('for (let x in x) {break;}return x;');
test('for (let x in x) {break;}return eval("x");');
test('a:for (let i in x) {for (let j in x) {break a;}}return x;');
test('a:for (let i in x) {for (let j in x) {break a;}}return eval("x");');
test('var j;for (let i in x) {j = i;break;}return j;', {ponies:true});
test('try {for (let x in eval("throw x")) {}} catch (e) {return e;}');
test('try {for each (let x in x) {eval("throw x");}} catch (e) {return e;}', ['ponies']);
isParseError('for (let [x, x] in o) {}');
isParseError('for (let [x, y, x] in o) {}');
isParseError('for (let [x, [y, [x]]] in o) {}');

// genexps
test('return (i for (i in x)).next();', {ponies:true});
test('return (eval("i") for (i in x)).next();', {ponies:true});
test('return (eval("i") for (i in eval("x"))).next();', {ponies:true});
test('try {return (eval("throw i") for (i in x)).next();} catch (e) {return e;}', {ponies:true});

// array comprehension
test('return [i for (i in x)][0];', {ponies:true});
test('return [eval("i") for (i in x)][0];', {ponies:true});
test('return [eval("i") for (i in eval("x"))][0];', {ponies:true});
test('try {return [eval("throw i") for (i in x)][0];} catch (e) {return e;}', {ponies:true});

// don't forget about switch craziness
test('var y = 3;switch (function () {return eval("y");}()) {case 3:let y;return x;default:;}');
test('switch (x) {case 3:let y;return 3;case 4:let z;return 4;default:return x;}');
test('switch (x) {case 3:let x;break;default:if (x === undefined) {return "ponies";}}');
test('switch (x) {case 3:default:let y;let (y = x) {return y;}}');
isParseError('switch (x) {case 3:let y;return 3;case 4:let y;return 4;default:;}');

// TDZ checks
isReferenceError('x + 1; let x = 42;');
isReferenceError('x = 42; let x;');
isReferenceError('inner(); function inner() { x++; } let x;');
isReferenceError('inner(); let x; function inner() { x++; }');
isReferenceError('inner(); let x; function inner() { function innerer() { x++; } innerer(); }');
isReferenceError('let x; var inner = function () { y++; }; inner(); let y;');
isReferenceError('let x = x;');
isReferenceError('let [x] = [x];');
isReferenceError('let {x} = {x:x};');
isReferenceError('switch (x) {case 3:let x;break;default:if (x === undefined) {return "ponies";}}');

(-)a/js/src/jit-test/tests/debug/Environment-variables.js (-2 lines)

Line	Link Here

Lines 25-42 var cases = [	Link Here

    "function f(x) { @@ } f(VAL);",

    "function f(x) { @@ } f(VAL);",

    "function f([w, x]) { @@ } f([0, VAL]);",

    "function f([w, x]) { @@ } f([0, VAL]);",

    "function f({v: x}) { @@ } f({v: VAL});",

    "function f({v: x}) { @@ } f({v: VAL});",

    "function f([w, {v: x}]) { @@ } f([0, {v: VAL}]);",

    "function f([w, {v: x}]) { @@ } f([0, {v: VAL}]);",

    // bindings in functions

    // bindings in functions

    "function f() { var x = VAL; @@ } f();",

    "function f() { var x = VAL; @@ } f();",

    "function f() { let x = VAL; @@ } f();",

    "function f() { let x = VAL; @@ } f();",

    "function f([x]) { let x = VAL; @@ } f(['fail']);",

    "function f(x) { { let x = VAL; @@ } } f('fail');",

    "function f() { function x() {} x = VAL; @@ } f();",

    "function f() { function x() {} x = VAL; @@ } f();",

    // dynamic bindings

    // dynamic bindings

    "function f(s) { eval(s); @@ } f('var x = VAL');",

    "function f(s) { eval(s); @@ } f('var x = VAL');",

    "function f(s) { let (x = 'fail') { eval(s); } x = VAL; @@ } f('var x;');",

    "function f(s) { let (x = 'fail') { eval(s); } x = VAL; @@ } f('var x;');",

    "var x = VAL; function f(s) { eval('var x = 0;'); eval(s); @@ } f('delete x;');",

    "var x = VAL; function f(s) { eval('var x = 0;'); eval(s); @@ } f('delete x;');",

    "function f(obj) { with (obj) { @@ } } f({x: VAL});",

    "function f(obj) { with (obj) { @@ } } f({x: VAL});",

    "function f(obj) { with (obj) { @@ } } f(Object.create({x: VAL}));",

    "function f(obj) { with (obj) { @@ } } f(Object.create({x: VAL}));",





        this.y = w
        this.y = (void 0)
        Object
    }
    for (a in [0, 0, 0, 0])
    {
        new f
    }
    var w = {}
})()

/* Make sure that MICs don't have the same bug. */
x = Object();
(function () {
    function f()
    {
        x = w
        x = (void 0)
        Object
    }
    for (a in [0, 0, 0, 0])
    {
        new f
    }
    var w = {}
})()
/* Don't assert. */

(-)a/js/src/jit-test/tests/parallel/write-array.js (-1 / +1 lines)

Line	Link Here

Lines 1-14	Link Here

load(libdir + "parallelarray-helpers.js");

load(libdir + "parallelarray-helpers.js");

function buildSimple() {

function buildSimple() {

  assertParallelModesCommute(["seq", "par"], function(m) {

  assertParallelModesCommute(["seq", "par"], function(m) {

    return Array.buildPar(256, function(i) {

    return Array.buildPar(256, function(i) {

      let obj = [0, 1, 2];

      var obj = [0, 1, 2];

      obj[0] += 1;

      obj[0] += 1;

      obj[1] += 1;

      obj[1] += 1;

      obj[2] += 1;

      obj[2] += 1;

      return obj;

      return obj;

    }, m);

    }, m);

});

});

(-)a/js/src/jit-test/tests/parallel/write-obj.js (-1 / +1 lines)

Line	Link Here

Lines 1-14	Link Here

load(libdir + "parallelarray-helpers.js");

load(libdir + "parallelarray-helpers.js");

function buildSimple() {

function buildSimple() {

  assertParallelModesCommute(["seq", "par"], function(m) {

  assertParallelModesCommute(["seq", "par"], function(m) {

    Array.buildPar(256, function(i) {

    Array.buildPar(256, function(i) {

      let obj = { x: i, y: i + 1, z: i + 2 };

      var obj = { x: i, y: i + 1, z: i + 2 };

      obj.x += 1;

      obj.x += 1;

      obj.y += 1;

      obj.y += 1;

      obj.z += 1;

      obj.z += 1;

      return obj;

      return obj;

    }, m);

    }, m);

});

});





        code->setHasBytecodeMap();
    }

    script->setBaselineScript(cx, baselineScript);

    return Method_Compiled;
}

void
BaselineCompiler::emitInitializeLocals(size_t n, const Value &v)
{
    MOZ_ASSERT(frame.nlocals() > 0 && n <= frame.nlocals());

    // Use R0 to minimize code size. If the number of locals to push is <
    // LOOP_UNROLL_FACTOR, then the initialization pushes are emitted directly
    // and inline.  Otherwise, they're emitted in a partially unrolled loop.
    static const size_t LOOP_UNROLL_FACTOR = 4;
    size_t toPushExtra = n % LOOP_UNROLL_FACTOR;

    masm.moveValue(v, R0);

    // Handle any extra pushes left over by the optional unrolled loop below.
    for (size_t i = 0; i < toPushExtra; i++)
        masm.pushValue(R0);

    // Partially unrolled loop of pushes.
    if (n >= LOOP_UNROLL_FACTOR) {
        size_t toPush = n - toPushExtra;
        JS_ASSERT(toPush % LOOP_UNROLL_FACTOR == 0);
        JS_ASSERT(toPush >= LOOP_UNROLL_FACTOR);
        masm.move32(Imm32(toPush), R1.scratchReg());
        // Emit unrolled loop with 4 pushes per iteration.
        Label pushLoop;
        masm.bind(&pushLoop);
        for (size_t i = 0; i < LOOP_UNROLL_FACTOR; i++)
            masm.pushValue(R0);
        masm.branchSub32(Assembler::NonZero,
                         Imm32(LOOP_UNROLL_FACTOR), R1.scratchReg(), &pushLoop);
    }
}

bool
BaselineCompiler::emitPrologue()
{
    masm.push(BaselineFrameReg);
    masm.mov(BaselineStackReg, BaselineFrameReg);

    masm.subPtr(Imm32(BaselineFrame::Size()), BaselineStackReg);
    masm.checkStackAlignment();

        if (!emitStackCheck(/* earlyCheck = */ true))
            return false;
        masm.branchTest32(Assembler::NonZero,
                          frame.addressOfFlags(),
                          Imm32(BaselineFrame::OVER_RECURSED),
                          &earlyStackCheckFailed);
    }

    // Initialize local vars to |undefined| and local lets to a magic value
    // that throws on touch.
    if (frame.nvars() > 0)
        emitInitializeLocals(frame.nvars(), UndefinedValue());
    if (frame.nlets() > 0)
        emitInitializeLocals(frame.nlets(), MagicValue(JS_UNINITIALIZED_LET));
        size_t toPushExtra = frame.nlocals() % LOOP_UNROLL_FACTOR;

        masm.moveValue(UndefinedValue(), R0);

        // Handle any extra pushes left over by the optional unrolled loop below.
        for (size_t i = 0; i < toPushExtra; i++)
            masm.pushValue(R0);

        // Partially unrolled loop of pushes.
        if (frame.nlocals() >= LOOP_UNROLL_FACTOR) {
            size_t toPush = frame.nlocals() - toPushExtra;
            JS_ASSERT(toPush % LOOP_UNROLL_FACTOR == 0);
            JS_ASSERT(toPush >= LOOP_UNROLL_FACTOR);
            masm.move32(Imm32(toPush), R1.scratchReg());
            // Emit unrolled loop with 4 pushes per iteration.
            Label pushLoop;
            masm.bind(&pushLoop);
            for (size_t i = 0; i < LOOP_UNROLL_FACTOR; i++)
                masm.pushValue(R0);
            masm.branchSub32(Assembler::NonZero,
                             Imm32(LOOP_UNROLL_FACTOR), R1.scratchReg(), &pushLoop);
        }
    }

    if (needsEarlyStackCheck())
        masm.bind(&earlyStackCheckFailed);

#ifdef JS_TRACE_LOGGING
    TraceLogger *logger = TraceLoggerForMainThread(cx->runtime());
    Register loggerReg = RegisterSet::Volatile().takeGeneral();
    masm.Push(loggerReg);

        script->setUninlineable();

    modifiesArguments_ = true;

    uint32_t arg = GET_ARGNO(pc);
    return emitFormalArgAccess(arg, /* get = */ false);
}

typedef bool (*ThrowUninitializedLetFn)(JSContext *cx);
static const VMFunction ThrowUninitializedLetInfo =
    FunctionInfo<ThrowUninitializedLetFn>(jit::ThrowUninitializedLet);

bool
BaselineCompiler::emitUninitializedLetCheck(const ValueOperand &val)
{
    Label done;
    masm.branchTestMagicValue(Assembler::NotEqual, val, JS_UNINITIALIZED_LET, &done);

    prepareVMCall();
    if (!callVM(ThrowUninitializedLetInfo))
        return false;

    masm.bind(&done);
    return true;
}


bool
BaselineCompiler::emit_JSOP_CHECKLET()
{
    frame.syncStack(0);
    masm.loadValue(frame.addressOfLocal(GET_LOCALNO(pc)), R0);
    return emitUninitializedLetCheck(R0);
}

bool
BaselineCompiler::emit_JSOP_INITLET()
{
    return emit_JSOP_SETLOCAL();
}

bool
BaselineCompiler::emit_JSOP_CHECKALIASEDLET()
{
    frame.syncStack(0);
    masm.loadValue(getScopeCoordinateAddress(R0.scratchReg()), R0);
    return emitUninitializedLetCheck(R0);
}

bool
BaselineCompiler::emit_JSOP_INITALIASEDLET()
{
    return emit_JSOP_SETALIASEDVAR();
}

bool
BaselineCompiler::emitCall()
{
    JS_ASSERT(IsCallPC(pc));

    uint32_t argc = GET_ARGC(pc);

    frame.syncStack(0);





    _(JSOP_DEFVAR)             \
    _(JSOP_DEFCONST)           \
    _(JSOP_SETCONST)           \
    _(JSOP_DEFFUN)             \
    _(JSOP_GETLOCAL)           \
    _(JSOP_SETLOCAL)           \
    _(JSOP_GETARG)             \
    _(JSOP_SETARG)             \
    _(JSOP_CHECKLET)           \
    _(JSOP_INITLET)            \
    _(JSOP_CHECKALIASEDLET)    \
    _(JSOP_INITALIASEDLET)     \
    _(JSOP_CALL)               \
    _(JSOP_FUNCALL)            \
    _(JSOP_FUNAPPLY)           \
    _(JSOP_NEW)                \
    _(JSOP_EVAL)               \
    _(JSOP_SPREADCALL)         \
    _(JSOP_SPREADNEW)          \
    _(JSOP_SPREADEVAL)         \

    BaselineCompiler(JSContext *cx, TempAllocator &alloc, JSScript *script);
    bool init();

    MethodStatus compile();

  private:
    MethodStatus emitBody();

    void emitInitializeLocals(size_t n, const Value &v);
    bool emitPrologue();
    bool emitEpilogue();
#ifdef JSGC_GENERATIONAL
    bool emitOutOfLinePostBarrierSlot();
#endif
    bool emitIC(ICStub *stub, ICEntry::Kind kind);
    bool emitOpIC(ICStub *stub) {
        return emitIC(stub, ICEntry::Kind_Op);

    bool emitCall();
    bool emitSpreadCall();

    bool emitInitPropGetterSetter();
    bool emitInitElemGetterSetter();

    bool emitFormalArgAccess(uint32_t arg, bool get);

    bool emitUninitializedLetCheck(const ValueOperand &val);

    bool addPCMappingEntry(bool addIndexEntry);

    void getScopeCoordinateObject(Register reg);
    Address getScopeCoordinateAddressFromObject(Register objReg, Register reg);
    Address getScopeCoordinateAddress(Register reg);
};

} // namespace jit





        gc::MarkScriptRoot(trc, &evalScript_, "baseline-evalscript");

    if (hasArgsObj())
        gc::MarkObjectRoot(trc, &argsObj_, "baseline-args-obj");

    // Mark locals and stack values.
    JSScript *script = this->script();
    size_t nfixed = script->nfixed();
    size_t nlivefixed = script->nbodyfixed();

    if (nfixed != nlivefixed) {
        jsbytecode *pc;
        NestedScopeObject *staticScope;

        frameIterator.baselineScriptAndPc(nullptr, &pc);
        staticScope = script->getStaticScope(pc);
        while (staticScope && !staticScope->is<StaticBlockObject>())


        if (staticScope) {
            StaticBlockObject &blockObj = staticScope->as<StaticBlockObject>();
            nlivefixed = blockObj.localOffset() + blockObj.numVariables();
        }
    }

    JS_ASSERT(nlivefixed <= nfixed);
    JS_ASSERT(nlivefixed >= script->nbodyfixed());

    // NB: It is possible that numValueSlots() could be zero, even if nfixed is
    // nonzero.  This is the case if the function has an early stack check.
    if (numValueSlots() == 0)
        return;

    JS_ASSERT(nfixed <= numValueSlots());






      : script(script),
        masm(masm),
        stack(),
        spIndex(0)
    { }

    bool init(TempAllocator &alloc);

    size_t nlocals() const {
        return script->nfixed();
    }
    size_t nargs() const {
        return script->functionNonDelazifying()->nargs();
    }
    size_t nvars() const {
        return script->nfixedvars();
    }
    size_t nlets() const {
        return script->fixedLetEnd() - script->fixedLetBegin();
    }

  private:
    inline StackValue *rawPush() {
        StackValue *val = &stack[spIndex++];
        val->reset();
        return val;
    }






        id = JSID_VOID;
        types::AddTypePropertyId(cx, obj, id, value);
        break;
      }
      case ICStub::SetProp_Native:
      case ICStub::SetProp_NativeAdd: {
        JS_ASSERT(obj->isNative());
        jsbytecode *pc = stub->getChainFallback()->icEntry()->pc(script);
        if (*pc == JSOP_SETALIASEDVAR || *pc == JSOP_INITALIASEDLET)
            id = NameToId(ScopeCoordinateName(cx->runtime()->scopeCoordinateNameCache, script, pc));
        else
            id = NameToId(script->getName(pc));
        types::AddTypePropertyId(cx, obj, id, value);
        break;
      }
      default:
        MOZ_ASSUME_UNREACHABLE("Invalid stub");

    mozilla::DebugOnly<JSOp> op = JSOp(*pc);
    FallbackICSpew(cx, stub, "BindName(%s)", js_CodeName[JSOp(*pc)]);

    JS_ASSERT(op == JSOP_BINDNAME);

    RootedPropertyName name(cx, frame->script()->getName(pc));

    RootedObject scope(cx);
    RootedShape shape(cx);
    if (!LookupNameUnqualified(cx, name, scopeChain, &scope, &shape))
        return false;

    res.setObject(*scope);
    return true;
}

typedef bool (*DoBindNameFallbackFn)(JSContext *, BaselineFrame *, ICBindName_Fallback *,
                                     HandleObject, MutableHandleValue);

    jsbytecode *pc = stub->icEntry()->pc(script);
    JSOp op = JSOp(*pc);
    FallbackICSpew(cx, stub, "SetProp(%s)", js_CodeName[op]);

    JS_ASSERT(op == JSOP_SETPROP ||
              op == JSOP_SETNAME ||
              op == JSOP_SETGNAME ||
              op == JSOP_INITPROP ||
              op == JSOP_SETALIASEDVAR ||
              op == JSOP_INITALIASEDLET);

    RootedPropertyName name(cx);
    if (op == JSOP_SETALIASEDVAR || op == JSOP_INITALIASEDLET)
        name = ScopeCoordinateName(cx->runtime()->scopeCoordinateNameCache, script, pc);
    else
        name = script->getName(pc);
    RootedId id(cx, NameToId(name));

    RootedObject obj(cx, ToObjectFromStack(cx, lhs));
    if (!obj)
        return false;

    if (op == JSOP_INITPROP) {
        MOZ_ASSERT(name != cx->names().proto, "should have used JSOP_MUTATEPROTO");
        MOZ_ASSERT(obj->is<JSObject>());
        if (!DefineNativeProperty(cx, obj, id, rhs, nullptr, nullptr, JSPROP_ENUMERATE))
            return false;
    } else if (op == JSOP_SETNAME || op == JSOP_SETGNAME) {
        if (!SetNameOperation(cx, script, pc, obj, rhs))
            return false;
    } else if (op == JSOP_SETALIASEDVAR || op == JSOP_INITALIASEDLET) {
        obj->as<ScopeObject>().setAliasedVar(cx, ScopeCoordinate(pc), name, rhs);
    } else {
        MOZ_ASSERT(op == JSOP_SETPROP);
        if (script->strict()) {
            if (!js::SetProperty<true>(cx, obj, id, rhs))
                return false;
        } else {
            if (!js::SetProperty<false>(cx, obj, id, rhs))





                  Imm32(0),
                  ool->entry());
    masm.bind(ool->rejoin());
    masm.bind(&done);

    return true;
}

typedef bool (*ThrowUninitializedLetFn)(JSContext *);
static const VMFunction ThrowUninitializedLetInfo =
    FunctionInfo<ThrowUninitializedLetFn>(ThrowUninitializedLet);

bool
CodeGenerator::visitLetCheck(LLetCheck *ins)
{
    OutOfLineCode *ool = oolCallVM(ThrowUninitializedLetInfo, ins, (ArgList()), StoreNothing());
    if (!ool)
        return false;
    ValueOperand inputValue = ToValue(ins, LLetCheck::Input);
    masm.branchTestMagicValue(Assembler::Equal, inputValue, JS_UNINITIALIZED_LET, ool->entry());
    masm.bind(ool->rejoin());
    return true;
}

bool
CodeGenerator::visitThrowUninitializedLet(LThrowUninitializedLet *ins)
{
    return callVM(ThrowUninitializedLetInfo, ins);
}

} // namespace jit
} // namespace js





    bool visitIsCallable(LIsCallable *lir);
    bool visitIsObject(LIsObject *lir);
    bool visitHaveSameClass(LHaveSameClass *lir);
    bool visitHasClass(LHasClass *lir);
    bool visitAsmJSCall(LAsmJSCall *lir);
    bool visitAsmJSParameter(LAsmJSParameter *lir);
    bool visitAsmJSReturn(LAsmJSReturn *ret);
    bool visitAsmJSVoidReturn(LAsmJSVoidReturn *ret);
    bool visitLetCheck(LLetCheck *ins);
    bool visitThrowUninitializedLet(LThrowUninitializedLet *ins);

    bool visitCheckOverRecursed(LCheckOverRecursed *lir);
    bool visitCheckOverRecursedFailure(CheckOverRecursedFailure *ool);

    bool visitCheckOverRecursedPar(LCheckOverRecursedPar *lir);

    bool visitInterruptCheckPar(LInterruptCheckPar *lir);
    bool visitOutOfLineInterruptCheckPar(OutOfLineInterruptCheckPar *ool);





            JS_ASSERT(fun_->isTenured());
        }

        osrStaticScope_ = osrPc ? script->getStaticScope(osrPc) : nullptr;

        nimplicit_ = StartArgSlot(script)                   /* scope chain and argument obj */
                   + (fun ? 1 : 0);                         /* this */
        nargs_ = fun ? fun->nargs() : 0;
        nbodyfixed_ = script->nbodyfixed();
        nlocals_ = script->nfixed();
        fixedLetBegin_ = script->fixedLetBegin();
        nstack_ = script->nslots() - script->nfixed();
        nslots_ = nimplicit_ + nargs_ + nlocals_ + nstack_;
    }

    CompileInfo(unsigned nlocals, ExecutionMode executionMode)
      : script_(nullptr), fun_(nullptr), osrPc_(nullptr), osrStaticScope_(nullptr),
        constructing_(false), executionMode_(executionMode), scriptNeedsArgsObj_(false),
        inlineScriptTree_(nullptr)
    {
        nimplicit_ = 0;
        nargs_ = 0;
        nbodyfixed_ = 0;
        nlocals_ = nlocals;
        nstack_ = 1;  /* For FunctionCompiler::pushPhiInput/popPhiOutput */
        nslots_ = nlocals_ + nstack_;
        fixedLetBegin_ = nlocals;
    }

    JSScript *script() const {
        return script_;
    }
    bool compilingAsmJS() const {
        return script() == nullptr;
    }

    // maybe argumentsobject and this value.
    unsigned nimplicit() const {
        return nimplicit_;
    }
    // Number of arguments (without counting this value).
    unsigned nargs() const {
        return nargs_;
    }
    // Number of slots needed for fixed body-level bindings.  Note that this
    // is only non-zero for function code.
    unsigned nbodyfixed() const {
        return nbodyfixed_;
    }
    // Number of slots needed for all local variables.  This includes "fixed
    // vars" (see above) and also block-scoped locals.
    unsigned nlocals() const {
        return nlocals_;
    }
    unsigned ninvoke() const {
        return nslots_ - nstack_;
    }
    // The slot number at which fixed lets begin.
    unsigned fixedLetBegin() const {
        return fixedLetBegin_;
    }

    uint32_t scopeChainSlot() const {
        JS_ASSERT(script());
        return 0;
    }
    uint32_t returnValueSlot() const {
        JS_ASSERT(script());
        return 1;

            return false;

        uint32_t arg = index - firstArgSlot();
        if (arg < nargs())
            return script()->formalIsAliased(arg);

        uint32_t local = index - firstLocalSlot();
        if (local < nlocals()) {
            // First, check if this local is body-level.
            if (local < nbodyfixed())
                return script()->bodyLevelLocalIsAliased(local);

            // Otherwise, it might be part of a block scope.
            for (; staticScope; staticScope = staticScope->enclosingNestedScope()) {
                if (!staticScope->is<StaticBlockObject>())
                    continue;
                StaticBlockObject &blockObj = staticScope->as<StaticBlockObject>();
                if (blockObj.localOffset() < local) {
                    if (local - blockObj.localOffset() < blockObj.numVariables())

        }

        return false;
    }

  private:
    unsigned nimplicit_;
    unsigned nargs_;
    unsigned nbodyfixed_;
    unsigned nlocals_;
    unsigned nstack_;
    unsigned nslots_;
    unsigned fixedLetBegin_;
    JSScript *script_;
    JSFunction *fun_;
    jsbytecode *osrPc_;
    NestedScopeObject *osrStaticScope_;
    bool constructing_;
    ExecutionMode executionMode_;

    // Whether a script needs an arguments object is unstable over compilation





        v = NullValue();
        break;
      case MIRType_MagicOptimizedArguments:
        v = MagicValue(JS_OPTIMIZED_ARGUMENTS);
        break;
      case MIRType_MagicOptimizedOut:
        v = MagicValue(JS_OPTIMIZED_OUT);
        break;
      case MIRType_MagicUninitializedLet:
        v = MagicValue(JS_UNINITIALIZED_LET);
        break;
      default:
        MOZ_ASSUME_UNREACHABLE("unexpected type");
    }
    MConstant *c = MConstant::New(alloc(), v);
    // The instruction pass will insert the box
    block->insertBefore(*(block->begin()), c);
    phi->replaceAllUsesWith(c);
}

    for (ReversePostorderIterator block(graph.rpoBegin()); block != graph.rpoEnd(); block++) {
        if (mir->shouldCancel("Insert Conversions"))
            return false;

        for (MPhiIterator phi(block->phisBegin()); phi != block->phisEnd();) {
            if (phi->type() == MIRType_Undefined ||
                phi->type() == MIRType_Null ||
                phi->type() == MIRType_MagicOptimizedArguments ||
                phi->type() == MIRType_MagicOptimizedOut ||
                phi->type() == MIRType_MagicUninitializedLet)
            {
                replaceRedundantPhi(*phi);
                phi = block->discardPhiAt(phi);
            } else {
                adjustPhiInputs(*phi);
                phi++;
            }
        }





    BaselineFrameInspector *inspector = temp->lifoAlloc()->new_<BaselineFrameInspector>(temp);
    if (!inspector)
        return nullptr;

    // Note: copying the actual values into a temporary structure for use
    // during compilation could capture nursery pointers, so the values' types
    // are recorded instead.

    inspector->thisType = types::GetMaybeUntrackedValueType(frame->thisValue());

    if (frame->scopeChain()->hasSingletonType())
        inspector->singletonScopeChain = frame->scopeChain();

    JSScript *script = frame->script();

    if (script->functionNonDelazifying()) {
        if (!inspector->argTypes.reserve(frame->numFormalArgs()))
            return nullptr;
        for (size_t i = 0; i < frame->numFormalArgs(); i++) {
            if (script->formalIsAliased(i)) {
                inspector->argTypes.infallibleAppend(types::Type::UndefinedType());
            } else if (!script->argsObjAliasesFormals()) {
                types::Type type = types::GetMaybeUntrackedValueType(frame->unaliasedFormal(i));
                inspector->argTypes.infallibleAppend(type);
            } else if (frame->hasArgsObj()) {
                types::Type type = types::GetMaybeUntrackedValueType(frame->argsObj().arg(i));
                inspector->argTypes.infallibleAppend(type);
            } else {
                inspector->argTypes.infallibleAppend(types::Type::UndefinedType());
            }
        }
    }

    if (!inspector->varTypes.reserve(frame->script()->nfixed()))
        return nullptr;
    for (size_t i = 0; i < frame->script()->nfixed(); i++) {
        if (info->isSlotAliasedAtOsr(i + info->firstLocalSlot())) {
            inspector->varTypes.infallibleAppend(types::Type::UndefinedType());
        } else {
            types::Type type = types::GetMaybeUntrackedValueType(frame->unaliasedLocal(i));
            inspector->varTypes.infallibleAppend(type);
        }
    }

    return inspector;
}

IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp,

    constraints_(constraints),
    analysis_(*temp, info->script()),
    thisTypes(nullptr),
    argTypes(nullptr),
    typeArray(nullptr),
    typeArrayHint(0),
    bytecodeTypeMap(nullptr),
    loopDepth_(loopDepth),
    letCheck_(nullptr),
    callerResumePoint_(nullptr),
    callerBuilder_(nullptr),
    cfgStack_(*temp),
    loops_(*temp),
    switches_(*temp),
    labels_(*temp),
    iterators_(*temp),
    loopHeaders_(*temp),

    } else {
        IonSpew(IonSpew_Scripts, "Compiling script %s:%d (%p) (usecount=%d, level=%s)",
                script()->filename(), script()->lineno(), (void *)script(),
                (int)script()->getUseCount(), OptimizationLevelString(optimizationInfo().level()));
    }
#endif

    initParameters();
    initLocals();
    // Initialize local variables.
    for (uint32_t i = 0; i < info().nlocals(); i++) {
        MConstant *undef = MConstant::New(alloc(), UndefinedValue());
        current->add(undef);
        current->initSlot(info().localSlot(i), undef);
    }

    // Initialize something for the scope chain. We can bail out before the
    // start instruction, but the snapshot is encoded *at* the start
    // instruction, which means generating any code that could load into
    // registers is illegal.
    MInstruction *scope = MConstant::New(alloc(), UndefinedValue());
    current->add(scope);
    current->initSlot(info().scopeChainSlot(), scope);

        current->add(arg);
        current->initSlot(info().argSlot(i), arg);
    }

    // Initialize the scope chain now that args are initialized.
    if (!initScopeChain(callInfo.fun()))
        return false;

    IonSpew(IonSpew_Inlining, "Initializing %u local slots; fixed lets starting at %u",
            info().nlocals(), info().fixedLetBegin());

    initLocals();
    for (uint32_t i = 0; i < info().nlocals(); i++) {
        MConstant *undef = MConstant::New(alloc(), UndefinedValue());
        current->add(undef);
        current->initSlot(info().localSlot(i), undef);
    }

    IonSpew(IonSpew_Inlining, "Inline entry block MResumePoint %p, %u operands",
            (void *) current->entryResumePoint(), current->entryResumePoint()->numOperands());

    // +2 for the scope chain and |this|, maybe another +1 for arguments object slot.
    JS_ASSERT(current->entryResumePoint()->numOperands() == info().totalSlots());

    if (script_->argumentsHasVarBinding()) {

        }

        param = MParameter::New(alloc(), i, types);
        current->add(param);
        current->initSlot(info().argSlotUnchecked(i), param);
    }
}

void
IonBuilder::initLocals()
{
    if (info().nlocals() == 0)
        return;

    MConstant *undef = nullptr;
    if (info().fixedLetBegin() > 0) {
        undef = MConstant::New(alloc(), UndefinedValue());
        current->add(undef);
    }

    MConstant *uninitLet = nullptr;
    if (info().fixedLetBegin() < info().nlocals()) {
        uninitLet = MConstant::New(alloc(), MagicValue(JS_UNINITIALIZED_LET));
        current->add(uninitLet);
    }

    for (uint32_t i = 0; i < info().nlocals(); i++)
        current->initSlot(info().localSlot(i), i < info().fixedLetBegin() ? undef : uninitLet);
}

bool
IonBuilder::initScopeChain(MDefinition *callee)
{
    MInstruction *scope = nullptr;

    // If the script doesn't use the scopechain, then it's already initialized
    // from earlier.  However, always make a scope chain when |needsArgsObj| is true
    // for the script, since arguments object construction requires the scope chain

              case JSOP_POPN:
              case JSOP_DUPAT:
              case JSOP_DUP:
              case JSOP_DUP2:
              case JSOP_PICK:
              case JSOP_SWAP:
              case JSOP_SETARG:
              case JSOP_SETLOCAL:
              case JSOP_INITLET:
              case JSOP_SETRVAL:
              case JSOP_VOID:
                // Don't require SSA uses for values popped by these ops.
                break;

              case JSOP_POS:
              case JSOP_TOID:
                // These ops may leave their input on the stack without setting

      case JSOP_GETLOCAL:
        current->pushLocal(GET_LOCALNO(pc));
        return true;

      case JSOP_SETLOCAL:
        current->setLocal(GET_LOCALNO(pc));
        return true;

      case JSOP_CHECKLET:
        return jsop_checklet();

      case JSOP_INITLET:
        current->setLocal(GET_LOCALNO(pc));
        return true;

      case JSOP_CHECKALIASEDLET:
        return jsop_checkaliasedlet(ScopeCoordinate(pc));

      case JSOP_INITALIASEDLET:
        return jsop_setaliasedvar(ScopeCoordinate(pc));

      case JSOP_POP:
        current->pop();

        // POP opcodes frequently appear where values are killed, e.g. after
        // SET* opcodes. Place a resume point afterwards to avoid capturing
        // the dead value in later snapshots, except in places where that
        // resume point is obviously unnecessary.
        if (pc[JSOP_POP_LENGTH] == JSOP_POP)

    // shape and can race with the main thread if we are building off thread.
    // The allocation kind and object class (which goes through the type) can
    // be read freely, however.
    gc::AllocKind kind = object->tenuredGetAllocKind();
    return gc::GetGCKindSlots(kind, object->getClass());
}

bool
IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, MDefinition *letCheck,
                          bool *psucceeded)
{
    jsid id = NameToId(name);

    JS_ASSERT(staticObject->is<GlobalObject>() || staticObject->is<CallObject>());
    JS_ASSERT(staticObject->hasSingletonType());

    *psucceeded = true;

    if (staticObject->is<GlobalObject>()) {
        // Known values on the global definitely don't need TDZ checks.
        if (letCheck)
            letCheck->setNotGuardUnchecked();

        // Optimize undefined, NaN, and Infinity.
        if (name == names().undefined)
            return pushConstant(UndefinedValue());
        if (name == names().NaN)
            return pushConstant(compartment->runtime()->NaNValue());
        if (name == names().Infinity)
            return pushConstant(compartment->runtime()->positiveInfinityValue());
    }

                     value, needsBarrier, slotType);
}

bool
IonBuilder::jsop_getgname(PropertyName *name)
{
    JSObject *obj = &script()->global();
    bool succeeded;
    if (!getStaticName(obj, name, /* letCheck = */ nullptr, &succeeded))
        return false;
    if (succeeded)
        return true;

    types::TemporaryTypeSet *types = bytecodeTypes(pc);
    MDefinition *globalObj = constant(ObjectValue(*obj));
    if (!getPropTryCommonGetter(&succeeded, globalObj, name, types))
        return false;

    // Also note that we don't call getPropTryCommonGetter below, because
    // (a) it requires a Baseline getter stub, which we don't have for outer
    // window proxies and (b) we have to be careful not to pass the inner
    // object to scripted getters etc. See bug 1007631.

    if (!getPropTryConstant(emitted, inner, name, types) || *emitted)
        return *emitted;

    if (!getStaticName(&script()->global(), name, /* letCheck = */ nullptr, emitted) || *emitted)
        return *emitted;

    // Passing the inner object to GetProperty IC is safe, see the
    // needsOuterizedThisObject check in IsCacheableGetPropCallNative.
    BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(),
                                                       inner, name, types);
    if (!getPropTryCache(emitted, inner, name, barrier, types) || *emitted)
        return *emitted;


    MDefFun *deffun = MDefFun::New(alloc(), fun, current->scopeChain());
    current->add(deffun);

    return resumeAfter(deffun);
}

bool
IonBuilder::jsop_checklet()
{
    uint32_t slot = info().localSlot(GET_LOCALNO(pc));
    MDefinition *let = addLetCheck(current->getSlot(slot));
    if (!let)
        return false;
    current->setSlot(slot, let);
    return true;
}

bool
IonBuilder::jsop_checkaliasedlet(ScopeCoordinate sc)
{
    MDefinition *let = addLetCheck(getAliasedVar(sc));
    if (!let)
        return false;

    jsbytecode *nextPc = pc + JSOP_CHECKALIASEDLET_LENGTH;
    MOZ_ASSERT(JSOp(*nextPc) == JSOP_GETALIASEDVAR || JSOp(*nextPc) == JSOP_SETALIASEDVAR);
    MOZ_ASSERT(sc == ScopeCoordinate(nextPc));

    // If we are checking for a load, push the checked let so that the load
    // can use it.
    if (JSOp(*nextPc) == JSOP_GETALIASEDVAR)
        setLetCheck(let);

    return true;
}

bool
IonBuilder::jsop_this()
{
    if (!info().funMaybeLazy())
        return abort("JSOP_THIS outside of a JSFunction.");

    if (info().funMaybeLazy()->isArrow()) {
        // Arrow functions store their lexical |this| in an extended slot.
        MLoadArrowThis *thisObj = MLoadArrowThis::New(alloc(), getCallee());

            *pcall = singletonScope;
            return true;
        }
    }

    return true;
}

MDefinition *
IonBuilder::getAliasedVar(ScopeCoordinate sc)
{
    MDefinition *obj = walkScopeChain(sc.hops());

    Shape *shape = ScopeCoordinateToStaticScopeShape(script(), pc);

    MInstruction *load;
    if (shape->numFixedSlots() <= sc.slot()) {
        MInstruction *slots = MSlots::New(alloc(), obj);
        current->add(slots);

        load = MLoadSlot::New(alloc(), slots, sc.slot() - shape->numFixedSlots());
    } else {
        load = MLoadFixedSlot::New(alloc(), obj, sc.slot());
    }

    current->add(load);
    return load;
}

bool
IonBuilder::jsop_getaliasedvar(ScopeCoordinate sc)
{
    JSObject *call = nullptr;
    if (hasStaticScopeObject(sc, &call) && call) {
        PropertyName *name = ScopeCoordinateName(scopeCoordinateNameCache, script(), pc);
        bool succeeded;
        if (!getStaticName(call, name, takeLetCheck(), &succeeded))
            return false;
        if (succeeded)
            return true;
    }

    // See jsop_checkaliasedlet.
    MDefinition *load = takeLetCheck();
    if (!load)
        load = getAliasedVar(sc);
    MInstruction *load;
    if (shape->numFixedSlots() <= sc.slot()) {
        MInstruction *slots = MSlots::New(alloc(), obj);
        current->add(slots);

        load = MLoadSlot::New(alloc(), slots, sc.slot() - shape->numFixedSlots());
    } else {
        load = MLoadFixedSlot::New(alloc(), obj, sc.slot());
    }

    current->add(load);
    current->push(load);

    types::TemporaryTypeSet *types = bytecodeTypes(pc);
    return pushTypeBarrier(load, types, BarrierKind::TypeSet);
}

bool
IonBuilder::jsop_setaliasedvar(ScopeCoordinate sc)

    if (inliningDepth_ == 0) {
        MInstruction *callee = MCallee::New(alloc());
        current->add(callee);
        return callee;
    }

    return inlineCallInfo_->fun();
}

MDefinition *
IonBuilder::addLetCheck(MDefinition *input)
{
    MOZ_ASSERT(JSOp(*pc) == JSOP_CHECKLET || JSOp(*pc) == JSOP_CHECKALIASEDLET);

    // If we're guaranteed to not be JS_UNINITIALIZED_MAGIC, no need to check.
    MInstruction *letCheck;
    if (input->type() == MIRType_MagicUninitializedLet)
        letCheck = MThrowUninitializedLet::New(alloc());
    else if (input->type() == MIRType_Value)
        letCheck = MLetCheck::New(alloc(), input);
    else
        return input;

    current->add(letCheck);
    if (!resumeAfter(letCheck))
        return nullptr;
    return letCheck->isLetCheck() ? letCheck : constant(UndefinedValue());
}





    bool resume(MInstruction *ins, jsbytecode *pc, MResumePoint::Mode mode);
    bool resumeAt(MInstruction *ins, jsbytecode *pc);
    bool resumeAfter(MInstruction *ins);
    bool maybeInsertResume();

    void insertRecompileCheck();

    void initParameters();
    void initLocals();
    void rewriteParameter(uint32_t slotIdx, MDefinition *param, int32_t argIndex);
    void rewriteParameters();
    bool initScopeChain(MDefinition *callee = nullptr);
    bool initArgumentsObject();
    bool pushConstant(const Value &v);

    MConstant *constant(const Value &v);
    MConstant *constantInt(int32_t i);

    MInstruction *addTypedArrayLength(MDefinition *obj) {
        MInstruction *length;
        addTypedArrayLengthAndData(obj, SkipBoundsCheck, nullptr, &length, nullptr);
        return length;
    }


    MDefinition *getCallee();
    MDefinition *getAliasedVar(ScopeCoordinate sc);
    MDefinition *addLetCheck(MDefinition *input);

    bool jsop_add(MDefinition *left, MDefinition *right);
    bool jsop_bitnot();
    bool jsop_bitop(JSOp op);
    bool jsop_binary(JSOp op);
    bool jsop_binary(JSOp op, MDefinition *left, MDefinition *right);
    bool jsop_pos();
    bool jsop_neg();
    bool jsop_setarg(uint32_t arg);
    bool jsop_defvar(uint32_t index);
    bool jsop_deffun(uint32_t index);
    bool jsop_notearg();
    bool jsop_checklet();
    bool jsop_checkaliasedlet(ScopeCoordinate sc);
    bool jsop_funcall(uint32_t argc);
    bool jsop_funapply(uint32_t argc);
    bool jsop_funapplyarguments(uint32_t argc);
    bool jsop_call(uint32_t argc, bool constructing);
    bool jsop_eval(uint32_t argc);
    bool jsop_ifeq(JSOp op);
    bool jsop_try();
    bool jsop_label();
    bool jsop_condswitch();
    bool jsop_andor(JSOp op);
    bool jsop_dup2();
    bool jsop_loophead(jsbytecode *pc);
    bool jsop_compare(JSOp op);
    bool getStaticName(JSObject *staticObject, PropertyName *name, MDefinition *letCheck,
                       bool *psucceeded);
    bool setStaticName(JSObject *staticObject, PropertyName *name);
    bool jsop_getgname(PropertyName *name);
    bool jsop_getname(PropertyName *name);
    bool jsop_intrinsic(PropertyName *name);
    bool jsop_bindname(PropertyName *name);
    bool jsop_getelem();
    bool jsop_getelem_dense(MDefinition *obj, MDefinition *index);
    bool jsop_getelem_typed(MDefinition *obj, MDefinition *index, ScalarTypeDescr::Type arrayType);

    MBasicBlock *current;
    uint32_t loopDepth_;

    BytecodeSite bytecodeSite(jsbytecode *pc) {
        JS_ASSERT(info().inlineScriptTree()->script()->containsPC(pc));
        return BytecodeSite(info().inlineScriptTree(), pc);
    }

    MDefinition *letCheck_;

    void setLetCheck(MDefinition *let) {
        MOZ_ASSERT(!letCheck_);
        letCheck_ = let;
    }
    MDefinition *takeLetCheck() {
        MDefinition *let = letCheck_;
        letCheck_ = nullptr;
        return let;
    }

    /* Information used for inline-call builders. */
    MResumePoint *callerResumePoint_;
    jsbytecode *callerPC() {
        return callerResumePoint_ ? callerResumePoint_->pc() : nullptr;
    }
    IonBuilder *callerBuilder_;

    bool oom() {





    IonScript *ion = outerScript->ionScript();
    BindNameIC &cache = ion->getCache(cacheIndex).toBindName();
    HandlePropertyName name = cache.name();

    RootedObject holder(cx);
    if (scopeChain->is<GlobalObject>()) {
        holder = scopeChain;
    } else {
        RootedShape shape(cx);
        if (!LookupNameUnqualified(cx, name, scopeChain, &holder, &shape))
            return nullptr;
    }

    // Stop generating new stubs once we hit the stub count limit, see
    // GetPropertyCache.
    if (cache.canAttachStub()) {
        if (scopeChain->is<GlobalObject>()) {
            if (!cache.attachGlobal(cx, outerScript, ion, scopeChain))





        // See the big comment in TryNoteIter::settle for more info.
        JS_ASSERT(frame.baselineFrame()->numValueSlots() >= script->nfixed());
        size_t stackDepth = frame.baselineFrame()->numValueSlots() - script->nfixed();
        if (tn->stackDepth > stackDepth)
            continue;

        // Unwind scope chain (pop block objects).
        if (cx->isExceptionPending()) {
            *unwoundScopeToPc = UnwindScopeToTryPc(script, tn);
            UnwindScope(cx, si, *unwoundScopeToPc);
        }

        // Compute base pointer and stack pointer.
        rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
        rfe->stackPointer = rfe->framePointer - BaselineFrame::Size() -
            (script->nfixed() + tn->stackDepth) * sizeof(Value);






    MIRType_Float32,
    MIRType_String,
    MIRType_Symbol,
    MIRType_Object,
    MIRType_MagicOptimizedArguments, // JS_OPTIMIZED_ARGUMENTS magic value.
    MIRType_MagicOptimizedOut,       // JS_OPTIMIZED_OUT magic value.
    MIRType_MagicHole,               // JS_ELEMENTS_HOLE magic value.
    MIRType_MagicIsConstructing,     // JS_IS_CONSTRUCTING magic value.
    MIRType_MagicUninitializedLet,   // JS_UNINITIALIZED_LET magic value.
    MIRType_Value,
    MIRType_None,                    // Invalid, used as a placeholder.
    MIRType_Slots,                   // A slots vector
    MIRType_Elements,                // An elements vector
    MIRType_Pointer,                 // An opaque pointer that receives no special treatment
    MIRType_Shape,                   // A Shape pointer.
    MIRType_ForkJoinContext,         // js::ForkJoinContext*
    MIRType_Last = MIRType_ForkJoinContext,

    case MIRType_String:
      return JSVAL_TYPE_STRING;
    case MIRType_Symbol:
      return JSVAL_TYPE_SYMBOL;
    case MIRType_MagicOptimizedArguments:
    case MIRType_MagicOptimizedOut:
    case MIRType_MagicHole:
    case MIRType_MagicIsConstructing:
    case MIRType_MagicUninitializedLet:
      return JSVAL_TYPE_MAGIC;
    default:
      JS_ASSERT(type == MIRType_Object);
      return JSVAL_TYPE_OBJECT;
  }
}

static inline JSValueTag

    case MIRType_MagicOptimizedArguments:
      return "MagicOptimizedArguments";
    case MIRType_MagicOptimizedOut:
      return "MagicOptimizedOut";
    case MIRType_MagicHole:
      return "MagicHole";
    case MIRType_MagicIsConstructing:
      return "MagicIsConstructing";
    case MIRType_MagicUninitializedLet:
      return "MagicUninitializedLet";
    case MIRType_Value:
      return "Value";
    case MIRType_None:
      return "None";
    case MIRType_Slots:
      return "Slots";
    case MIRType_Elements:
      return "Elements";





    const LDefinition *scratch() {
        return getTemp(0);
    }
    MRecompileCheck *mir() {
        return mir_->toRecompileCheck();
    }
};

class LLetCheck : public LInstructionHelper<0, BOX_PIECES, 0>
{
  public:
    LIR_HEADER(LetCheck)

    MLetCheck *mir() {
        return mir_->toLetCheck();
    }

    static const size_t Input = 0;
};

class LThrowUninitializedLet : public LCallInstructionHelper<0, 0, 0>
{
  public:
    LIR_HEADER(ThrowUninitializedLet)

    MLetCheck *mir() {
        return mir_->toLetCheck();
    }
};

} // namespace jit
} // namespace js

#endif /* jit_LIR_Common_h */





    _(AsmJSVoidReturn)              \
    _(AsmJSPassStackArg)            \
    _(AsmJSCall)                    \
    _(InterruptCheckPar)            \
    _(RecompileCheck)               \
    _(AssertRangeI)                 \
    _(AssertRangeD)                 \
    _(AssertRangeF)                 \
    _(AssertRangeV)                 \
    _(LetCheck)                     \
    _(ThrowUninitializedLet)

#if defined(JS_CODEGEN_X86)
# include "jit/x86/LOpcodes-x86.h"
#elif defined(JS_CODEGEN_X64)
# include "jit/x64/LOpcodes-x64.h"
#elif defined(JS_CODEGEN_ARM)
# include "jit/arm/LOpcodes-arm.h"
#elif defined(JS_CODEGEN_MIPS)





        LSimdBinaryArithFx4 *add = new(alloc()) LSimdBinaryArithFx4();
        return lowerForFPU(add, ins, ins->lhs(), ins->rhs());
    }

    MOZ_ASSUME_UNREACHABLE("Unknown SIMD kind when adding values");
    return false;
}

bool
LIRGenerator::visitLetCheck(MLetCheck *ins)
{
    MDefinition *input = ins->input();
    MOZ_ASSERT(input->type() == MIRType_Value);
    LLetCheck *lir = new(alloc()) LLetCheck();
    return redefine(ins, input) && useBox(lir, LLetCheck::Input, input) &&
           add(lir, ins) && assignSafepoint(lir, ins);
}

bool
LIRGenerator::visitThrowUninitializedLet(MThrowUninitializedLet *ins)
{
    LThrowUninitializedLet *lir = new(alloc()) LThrowUninitializedLet();
    return add(lir, ins) && assignSafepoint(lir, ins);
}

static void
SpewResumePoint(MBasicBlock *block, MInstruction *ins, MResumePoint *resumePoint)
{
    fprintf(IonSpewFile, "Current resume point %p details:\n", (void *)resumePoint);
    fprintf(IonSpewFile, "    frame count: %u\n", resumePoint->frameCount());

    if (ins) {
        fprintf(IonSpewFile, "    taken after: ");





    bool visitSimdExtractElement(MSimdExtractElement *ins);
    bool visitSimdBinaryArith(MSimdBinaryArith *ins);
    bool visitSimdValueX4(MSimdValueX4 *ins);
    bool visitSimdConstant(MSimdConstant *ins);
    bool visitPhi(MPhi *ins);
    bool visitBeta(MBeta *ins);
    bool visitObjectState(MObjectState *ins);
    bool visitArrayState(MArrayState *ins);
    bool visitLetCheck(MLetCheck *ins);
    bool visitThrowUninitializedLet(MThrowUninitializedLet *ins);
};

} // namespace jit
} // namespace js

#endif /* jit_Lowering_h */





        fprintf(fp, "magic hole");
        break;
      case MIRType_MagicIsConstructing:
        fprintf(fp, "magic is-constructing");
        break;
      case MIRType_MagicOptimizedOut:
        fprintf(fp, "magic optimized-out");
        break;
      case MIRType_MagicUninitializedLet:
        fprintf(fp, "magic uninitialized-let");
        break;
      default:
        MOZ_ASSUME_UNREACHABLE("unexpected type");
    }
}

bool
MConstant::canProduceFloat32() const
{





          case JS_OPTIMIZED_ARGUMENTS:
            return MIRType_MagicOptimizedArguments;
          case JS_OPTIMIZED_OUT:
            return MIRType_MagicOptimizedOut;
          case JS_ELEMENTS_HOLE:
            return MIRType_MagicHole;
          case JS_IS_CONSTRUCTING:
            return MIRType_MagicIsConstructing;
          case JS_UNINITIALIZED_LET:
            return MIRType_MagicUninitializedLet;
          default:
            MOZ_ASSERT(!"Unexpected magic constant");
        }
    }
    return MIRTypeFromValueType(vp.extractNonDoubleType());
}

#define MIR_FLAG_LIST(_)                                                        \

    Label *interruptExit() const {
        return interruptExit_;
    }
    const CallSiteDesc &funcDesc() const {
        return funcDesc_;
    }
};

// Checks if a value is an uninitialized let, throwing if so.
class MLetCheck
  : public MUnaryInstruction,
    public BoxPolicy<0>
{
    explicit MLetCheck(MDefinition *input)
      : MUnaryInstruction(input)
    {
        setGuard();
        setResultType(MIRType_Value);
        setResultTypeSet(input->resultTypeSet());
    }

  public:
    INSTRUCTION_HEADER(LetCheck)

    static MLetCheck *New(TempAllocator &alloc, MDefinition *input) {
        return new(alloc) MLetCheck(input);
    }

    AliasSet getAliasSet() const {
        return AliasSet::None();
    }

    MDefinition *input() const {
        return getOperand(0);
    }
};

// Unconditionally throw an uninitialized let error.
class MThrowUninitializedLet : public MNullaryInstruction
{
    MThrowUninitializedLet() {
        setGuard();
        setResultType(MIRType_None);
    }

  public:
    INSTRUCTION_HEADER(ThrowUninitializedLet)

    static MThrowUninitializedLet *New(TempAllocator &alloc) {
        return new(alloc) MThrowUninitializedLet();
    }

    AliasSet getAliasSet() const {
        return AliasSet::None();
    }
};

// If not defined, set a global variable to |undefined|.
class MDefVar : public MUnaryInstruction
{
    CompilerRootPropertyName name_; // Target name to be defined.
    unsigned attrs_; // Attributes to be set.

  private:
    MDefVar(PropertyName *name, unsigned attrs, MDefinition *scopeChain)





    _(NewDenseArrayPar)                                                     \
    _(NewDerivedTypedObject)                                                \
    _(LambdaPar)                                                            \
    _(RestPar)                                                              \
    _(ForkJoinContext)                                                      \
    _(ForkJoinGetSlice)                                                     \
    _(GuardThreadExclusive)                                                 \
    _(InterruptCheckPar)                                                    \
    _(RecompileCheck)                                                       \
    _(LetCheck)                                                             \
    _(ThrowUninitializedLet)

// Forward declarations of MIR types.
#define FORWARD_DECLARE(op) class M##op;
 MIR_OPCODE_LIST(FORWARD_DECLARE)
#undef FORWARD_DECLARE

class MDefinitionVisitor // interface i.e. pure abstract class
{





    UNSAFE_OP(AsmJSLoadFuncPtr)
    UNSAFE_OP(AsmJSLoadFFIFunc)
    UNSAFE_OP(AsmJSReturn)
    UNSAFE_OP(AsmJSVoidReturn)
    UNSAFE_OP(AsmJSPassStackArg)
    UNSAFE_OP(AsmJSParameter)
    UNSAFE_OP(AsmJSCall)
    DROP_OP(RecompileCheck)
    UNSAFE_OP(LetCheck)
    UNSAFE_OP(ThrowUninitializedLet)

    // It looks like this could easily be made safe:
    UNSAFE_OP(ConvertElementsToDoubles)
};

static void
TransplantResumePoint(MInstruction *oldInstruction, MInstruction *replacementInstruction)
{





    return true;
}

bool
DebugEpilogue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool ok)
{
    // Unwind scope chain to stack depth 0.
    ScopeIter si(frame, pc, cx);
    UnwindAllScopes(cx, si);
    jsbytecode *unwindPc = frame->script()->main();
    UnwindScope(cx, si, unwindPc);
    frame->setUnwoundScopeOverridePc(unwindPc);

    // If ScriptDebugEpilogue returns |true| we have to return the frame's
    // return value. If it returns |false|, the debugger threw an exception.
    // In both cases we have to pop debug scopes.
    ok = ScriptDebugEpilogue(cx, frame, pc, ok);

    if (frame->isNonEvalFunctionFrame()) {

JSObject *
TypedObjectProto(JSObject *obj)
{
    JS_ASSERT(obj->is<TypedObject>());
    TypedObject &typedObj = obj->as<TypedObject>();
    return &typedObj.typedProto();
}

bool
ThrowUninitializedLet(JSContext *cx)
{
    ScriptFrameIter iter(cx);
    RootedScript script(cx, iter.script());
    ReportUninitializedLet(cx, script, iter.pc());
    return false;
}

} // namespace jit
} // namespace js

(-)a/js/src/jit/VMFunctions.h (+2 lines)

Line	Link Here

Lines 711-722 bool SetDenseElement(JSContext *cx, HandleObject obj, int32_t index, HandleValue	Link Here

711

void AssertValidObjectPtr(JSContext *cx, JSObject *obj);

711

void AssertValidObjectPtr(JSContext *cx, JSObject *obj);

712

void AssertValidStringPtr(JSContext *cx, JSString *str);

712

void AssertValidStringPtr(JSContext *cx, JSString *str);

713

void AssertValidSymbolPtr(JSContext *cx, JS::Symbol *sym);

713

void AssertValidSymbolPtr(JSContext *cx, JS::Symbol *sym);

714

void AssertValidValue(JSContext *cx, Value *v);

714

void AssertValidValue(JSContext *cx, Value *v);

715

#endif

715

#endif

716

717

JSObject *TypedObjectProto(JSObject *obj);

717

JSObject *TypedObjectProto(JSObject *obj);

718

719

bool ThrowUninitializedLet(JSContext *cx);

720

719

} // namespace jit

721

} // namespace jit

720

} // namespace js

722

} // namespace js

721

723

722

#endif /* jit_VMFunctions_h */

724

#endif /* jit_VMFunctions_h */





            if (!graph.addConstantToPool(constant->value(), &index))
                return false;
            alloc = RValueAllocation::ConstantPool(index);
        }
        break;
      }
      case MIRType_MagicOptimizedArguments:
      case MIRType_MagicOptimizedOut:
      case MIRType_MagicUninitializedLet:
      {
        uint32_t index;
        Value v = MagicValue(type == MIRType_MagicOptimizedArguments
                             ? JS_OPTIMIZED_ARGUMENTS
                             : (type == MIRType_MagicOptimizedOut
                                ? JS_OPTIMIZED_OUT
                                : JS_UNINITIALIZED_LET));
        if (!graph.addConstantToPool(v, &index))
            return false;
        alloc = RValueAllocation::ConstantPool(index);
        break;
      }
      default:
      {
        JS_ASSERT(mir->type() == MIRType_Value);






// Runtime errors
MSG_DEF(JSMSG_BAD_INSTANCEOF_RHS,      1, JSEXN_TYPEERR, "invalid 'instanceof' operand {0}")
MSG_DEF(JSMSG_BAD_LEFTSIDE_OF_ASS,     0, JSEXN_REFERENCEERR, "invalid assignment left-hand side")
MSG_DEF(JSMSG_BAD_PROTOTYPE,           1, JSEXN_TYPEERR, "'prototype' property of {0} is not an object")
MSG_DEF(JSMSG_IN_NOT_OBJECT,           1, JSEXN_TYPEERR, "invalid 'in' operand {0}")
MSG_DEF(JSMSG_TOO_MANY_CON_SPREADARGS, 0, JSEXN_RANGEERR, "too many constructor arguments")
MSG_DEF(JSMSG_TOO_MANY_FUN_SPREADARGS, 0, JSEXN_RANGEERR, "too many function arguments")
MSG_DEF(JSMSG_UNINITIALIZED_LET,       1, JSEXN_REFERENCEERR, "can't access let declaration `{0}' before initialization")

// Date
MSG_DEF(JSMSG_INVALID_DATE,            0, JSEXN_RANGEERR, "invalid date")
MSG_DEF(JSMSG_BAD_TOISOSTRING_PROP,    0, JSEXN_TYPEERR, "toISOString property is not callable")

// String
MSG_DEF(JSMSG_BAD_URI,                 0, JSEXN_URIERR, "malformed URI sequence")
MSG_DEF(JSMSG_INVALID_NORMALIZE_FORM,  0, JSEXN_RANGEERR, "form must be one of 'NFC', 'NFD', 'NFKC', or 'NFKD'")






    static js::ThingRootKind rootKind() { return js::THING_ROOT_TYPE; }
};

/* Get the type of a jsval, or zero for an unknown special value. */
inline Type GetValueType(const Value &val);

/*
 * Get the type of a possibly optimized out or uninitialized let value. This
 * generally only happens on unconditional type monitors on bailing out of
 * Ion, such as for argument and local types.
 */
inline Type GetMaybeUntrackedValueType(const Value &val);

/*
 * Type inference memory management overview.
 *
 * Type information about the values observed within scripts and about the
 * contents of the heap is accumulated as the program executes. Compilation
 * accumulates constraints relating type information on the heap with the
 * compilations that should be invalidated when those types change. Type





    if (val.isDouble())
        return Type::DoubleType();
    if (val.isObject())
        return Type::ObjectType(&val.toObject());
    return Type::PrimitiveType(val.extractNonDoubleType());
}

inline Type
GetMaybeUntrackedValueType(const Value &val)
{
    if (val.isMagic() && (val.whyMagic() == JS_OPTIMIZED_OUT ||
                          val.whyMagic() == JS_UNINITIALIZED_LET))
    {
        return Type::UnknownType();
    }
    return GetValueType(val);
}

inline TypeFlags
PrimitiveTypeFlag(JSValueType type)
{
    switch (type) {
      case JSVAL_TYPE_UNDEFINED:





        }
    }

    return true;
}

bool
js::LookupNameWithGlobalDefault(JSContext *cx, HandlePropertyName name, HandleObject scopeChain,
                                MutableHandleObject objp, MutableHandleShape propp)
{
    RootedId id(cx, NameToId(name));

    RootedObject pobj(cx);
    RootedShape prop(cx);

    RootedObject scope(cx, scopeChain);
    for (; !scope->is<GlobalObject>(); scope = scope->enclosingScope()) {
        if (!JSObject::lookupGeneric(cx, scope, id, &pobj, propp))
            return false;
        if (propp)
            break;
    }

    objp.set(scope);
    return true;
}

bool
js::LookupNameUnqualified(JSContext *cx, HandlePropertyName name, HandleObject scopeChain,
                          MutableHandleObject objp, MutableHandleShape propp)
{
    RootedId id(cx, NameToId(name));

    RootedObject pobj(cx);
    RootedShape prop(cx);

    RootedObject scope(cx, scopeChain);
    for (; !scope->isUnqualifiedVarObj(); scope = scope->enclosingScope()) {
        if (!JSObject::lookupGeneric(cx, scope, id, &pobj, propp))
            return false;
        if (propp)
            break;
    }

    objp.set(scope);
    return true;
}

template <AllowGC allowGC>

                typename MaybeRooted<JSObject*, allowGC>::HandleType pobj,
                typename MaybeRooted<Shape*, allowGC>::HandleType shape,
                typename MaybeRooted<Value, allowGC>::MutableHandleType vp)
{
    JS_ASSERT(pobj->isNative());

    if (shape->hasSlot()) {
        vp.set(pobj->nativeGetSlot(shape->slot()));
        JS_ASSERT_IF(!vp.isMagic(JS_UNINITIALIZED_LET) &&
                     !pobj->hasSingletonType() &&
                     !pobj->template is<ScopeObject>() &&
                     shape->hasDefaultGetter(),
                     js::types::TypeHasProperty(cx, pobj->type(), shape->propid(), vp));
    } else {
        vp.setUndefined();
    }
    if (shape->hasDefaultGetter())
        return true;





 * Like LookupName except returns the global object if 'name' is not found in
 * any preceding scope.
 *
 * Additionally, pobjp and propp are not needed by callers so they are not
 * returned.
 */
extern bool
LookupNameWithGlobalDefault(JSContext *cx, HandlePropertyName name, HandleObject scopeChain,
                            MutableHandleObject objp, MutableHandleShape propp);

/*
 * Like LookupName except returns the unqualified var object if 'name' is not found in
 * any preceding scope. Normally the unqualified var object is the global.
 *
 * Additionally, pobjp is not needed by callers so it is not returned.
 * returned.
 */
extern bool
LookupNameUnqualified(JSContext *cx, HandlePropertyName name, HandleObject scopeChain,
                      MutableHandleObject objp, MutableHandleShape propp);

}

extern JSObject *
js_FindVariableScope(JSContext *cx, JSFunction **funp);


namespace js {





    JS_ASSERT(slot < script->bindings.count());
    return (*localNames)[slot].name();
}

JSAtom *
ExpressionDecompiler::getLocal(uint32_t local, jsbytecode *pc)
{
    JS_ASSERT(local < script->nfixed());
    if (local < script->nbodyfixed()) {
        JS_ASSERT(fun);
        uint32_t slot = local + fun->nargs();
        JS_ASSERT(slot < script->bindings.count());
        return (*localNames)[slot].name();
    }
    for (NestedScopeObject *chain = script->getStaticScope(pc);
         chain;
         chain = chain->enclosingNestedScope()) {





    BindingIter bi(bindings);
    while (bi->name() != arguments)
        bi++;
    return bi.frameIndex();
}

bool
Bindings::initWithTemporaryStorage(ExclusiveContext *cx, InternalBindingsHandle self,
                                   uint32_t numArgs, uint32_t numVars,
                                   uint32_t numBodyLevelLets, uint32_t numBlockScoped,
                                   Binding *bindingArray)
{
    JS_ASSERT(!self->callObjShape_);
    JS_ASSERT(self->bindingArrayAndFlag_ == TEMPORARY_STORAGE_BIT);
    JS_ASSERT(!(uintptr_t(bindingArray) & TEMPORARY_STORAGE_BIT));
    JS_ASSERT(numArgs <= ARGC_LIMIT);
    JS_ASSERT(numVars <= LOCALNO_LIMIT);
    JS_ASSERT(numBlockScoped <= LOCALNO_LIMIT);
    JS_ASSERT(numBodyLevelLets <= LOCALNO_LIMIT);
    uint64_t totalSlots = uint64_t(numVars) + uint64_t(numBodyLevelLets) + uint64_t(numBlockScoped);
    JS_ASSERT(totalSlots <= LOCALNO_LIMIT);
    JS_ASSERT(UINT32_MAX - numArgs >= totalSlots);

    self->bindingArrayAndFlag_ = uintptr_t(bindingArray) | TEMPORARY_STORAGE_BIT;
    self->numArgs_ = numArgs;
    self->numVars_ = numVars;
    self->numBodyLevelLets_ = numBodyLevelLets;
    self->numBlockScoped_ = numBlockScoped;

    // Get the initial shape to use when creating CallObjects for this script.
    // After creation, a CallObject's shape may change completely (via direct eval() or
    // other operations that mutate the lexical scope). However, since the
    // lexical bindings added to the initial shape are permanent and the
    // allocKind/nfixed of a CallObject cannot change, one may assume that the
    // slot location (whether in the fixed or dynamic slots) of a variable is

    // JITs when interpreting/compiling aliasedvar ops.)

    // Since unaliased variables are, by definition, only accessed by local
    // operations and never through the scope chain, only give shapes to
    // aliased variables. While the debugger may observe any scope object at
    // any time, such accesses are mediated by DebugScopeProxy (see
    // DebugScopeProxy::handleUnaliasedAccess).
    uint32_t nslots = CallObject::RESERVED_SLOTS;
    uint32_t aliasedBodyLevelLetStart = UINT16_MAX;
    for (BindingIter bi(self); bi; bi++) {
        if (bi->aliased()) {
            // Per ES6, lets cannot be accessed until initialized. Remember
            // the first aliased slot that is a body-level let, so that they
            // may be initialized to sentinel magic values.
            if (numBodyLevelLets > 0 &&
                nslots < aliasedBodyLevelLetStart &&
                bi->kind() == Binding::VARIABLE &&
                bi.frameIndex() >= numVars)
            {
                aliasedBodyLevelLetStart = nslots;
            }

            nslots++;
        }
    }
    self->aliasedBodyLevelLetStart_ = aliasedBodyLevelLetStart;

    // Put as many of nslots inline into the object header as possible.
    uint32_t nfixed = gc::GetGCKindSlots(gc::GetGCObjectKind(nslots));

    // Start with the empty shape and then append one shape per aliased binding.
    RootedShape shape(cx,
        EmptyShape::getInitialShape(cx, &CallObject::class_, TaggedProto(nullptr), nullptr, nullptr,
                                    nfixed, BaseShape::QUALIFIED_VAROBJ | BaseShape::DELEGATE));

    JS_ASSERT(off >= 0);
    JS_ASSERT(size_t(off) <= srcScript->dataSize());
    Binding *dstPackedBindings = (Binding *)(dstScriptData + off);

    /*
     * Since atoms are shareable throughout the runtime, we can simply copy
     * the source's bindingArray directly.
     */
    if (!initWithTemporaryStorage(cx, self, src.numArgs(), src.numVars(),
                                  src.numBodyLevelLets(), src.numBlockScoped(),
                                  src.bindingArray()))
    {
        return false;
    }

    self->switchToScriptStorage(dstPackedBindings);
    return true;
}

/* static */ Bindings
GCMethods<Bindings>::initial()
{
    return Bindings();
}

template<XDRMode mode>
static bool
XDRScriptBindings(XDRState<mode> *xdr, LifoAllocScope &las, uint16_t numArgs, uint32_t numVars,
                  uint16_t numBodyLevelLets, uint16_t numBlockScoped, HandleScript script)
{
    JSContext *cx = xdr->cx();

    if (mode == XDR_ENCODE) {
        for (BindingIter bi(script); bi; bi++) {
            RootedAtom atom(cx, bi->name());
            if (!XDRAtom(xdr, &atom))
                return false;
        }

        for (BindingIter bi(script); bi; bi++) {
            uint8_t u8 = (uint8_t(bi->kind()) << 1) | uint8_t(bi->aliased());
            if (!xdr->codeUint8(&u8))
                return false;
        }
    } else {
        uint32_t nameCount = numArgs + numVars + numBodyLevelLets;

        AutoValueVector atoms(cx);
        if (!atoms.resize(nameCount))
            return false;
        for (uint32_t i = 0; i < nameCount; i++) {
            RootedAtom atom(cx);
            if (!XDRAtom(xdr, &atom))
                return false;

            PropertyName *name = atoms[i].toString()->asAtom().asPropertyName();
            Binding::Kind kind = Binding::Kind(u8 >> 1);
            bool aliased = bool(u8 & 1);

            bindingArray[i] = Binding(name, kind, aliased);
        }

        InternalBindingsHandle bindings(script, &script->bindings);
        if (!Bindings::initWithTemporaryStorage(cx, bindings, numArgs, numVars, numBodyLevelLets,
                                                numBlockScoped, bindingArray))
        {
            return false;
        }
    }

    return true;
}

bool
Bindings::bindingIsAliased(uint32_t bindingIndex)
{


// Code LazyScript's free variables.
template<XDRMode mode>
static bool
XDRLazyFreeVariables(XDRState<mode> *xdr, MutableHandle<LazyScript *> lazy)
{
    JSContext *cx = xdr->cx();
    RootedAtom atom(cx);
    LazyScript::FreeVariable *freeVariables = lazy->freeVariables();
    size_t numFreeVariables = lazy->numFreeVariables();
    for (size_t i = 0; i < numFreeVariables; i++) {
        if (mode == XDR_ENCODE)
            atom = freeVariables[i].atom();

        if (!XDRAtom(xdr, &atom))
            return false;

        if (mode == XDR_DECODE)
            freeVariables[i] = LazyScript::FreeVariable(atom);
    }

    return true;
}

// Code the missing part needed to re-create a LazyScript from a JSScript.
template<XDRMode mode>
static bool

    JSContext *cx = xdr->cx();
    RootedScript script(cx);
    natoms = nsrcnotes = 0;
    nconsts = nobjects = nregexps = ntrynotes = nblockscopes = 0;

    /* XDR arguments and vars. */
    uint16_t nargs = 0;
    uint16_t nblocklocals = 0;
    uint16_t nbodylevellets = 0;
    uint32_t nvars = 0;
    if (mode == XDR_ENCODE) {
        script = scriptp.get();
        JS_ASSERT_IF(enclosingScript, enclosingScript->compartment() == script->compartment());

        nargs = script->bindings.numArgs();
        nblocklocals = script->bindings.numBlockScoped();
        nbodylevellets = script->bindings.numBodyLevelLets();
        nvars = script->bindings.numVars();
    }
    if (!xdr->codeUint16(&nargs))
        return false;
    if (!xdr->codeUint16(&nblocklocals))
        return false;
    if (!xdr->codeUint16(&nbodylevellets))
        return false;
    if (!xdr->codeUint32(&nvars))
        return false;

    if (mode == XDR_ENCODE)
        length = script->length();
    if (!xdr->codeUint32(&length))
        return false;


        script = JSScript::Create(cx, enclosingScope, !!(scriptBits & (1 << SavedCallerFun)),
                                  options, /* staticLevel = */ 0, sourceObject, 0, 0);
        if (!script)
            return false;
    }

    /* JSScript::partiallyInit assumes script->bindings is fully initialized. */
    LifoAllocScope las(&cx->tempLifoAlloc());
    if (!XDRScriptBindings(xdr, las, nargs, nvars, nbodylevellets, nblocklocals, script))
        return false;

    if (mode == XDR_DECODE) {
        if (!JSScript::partiallyInit(cx, script, nconsts, nobjects, nregexps, ntrynotes,
                                     nblockscopes, nTypeSets))
        {
            return false;
        }

        MarkObject(trc, &sourceObject_, "sourceObject");

    if (enclosingScope_)
        MarkObject(trc, &enclosingScope_, "enclosingScope");

    if (script_)
        MarkScript(trc, &script_, "realScript");

    // We rely on the fact that atoms are always tenured.
    FreeVariable *freeVariables = this->freeVariables();
    for (size_t i = 0; i < numFreeVariables(); i++) {
        JSAtom *atom = freeVariables[i].atom();
        MarkStringUnbarriered(trc, &atom, "lazyScriptFreeVariable");
    }

    HeapPtrFunction *innerFunctions = this->innerFunctions();
    for (size_t i = 0; i < numInnerFunctions(); i++)
        MarkObject(trc, &innerFunctions[i], "lazyScriptInnerFunction");
}

void
LazyScript::finalize(FreeOp *fop)

    }

    return true;
}

bool
JSScript::varIsAliased(uint32_t varSlot)
{
    return bodyLevelLocalIsAliased(varSlot);
}

bool
JSScript::bodyLevelLocalIsAliased(uint32_t localSlot)
{
    return bindings.bindingIsAliased(bindings.numArgs() + localSlot);
}

bool
JSScript::formalIsAliased(unsigned argSlot)
{
    return bindings.bindingIsAliased(argSlot);
}


    };

    packed = packedFields;

    // Reset runtime flags to obtain a fresh LazyScript.
    p.hasBeenCloned = false;
    p.treatAsRunOnce = false;

    size_t bytes = (p.numFreeVariables * sizeof(FreeVariable))
                 + (p.numInnerFunctions * sizeof(HeapPtrFunction));

    ScopedJSFreePtr<uint8_t> table(bytes ? fun->zone()->pod_malloc<uint8_t>(bytes) : nullptr);
    if (bytes && !table)
        return nullptr;

    LazyScript *res = js_NewGCLazyScript(cx);
    if (!res)


    LazyScript *res = LazyScript::CreateRaw(cx, fun, packedFields, begin, end, lineno, column);
    if (!res)
        return nullptr;

    // Fill with dummies, to be GC-safe after the initialization of the free
    // variables and inner functions.
    size_t i, num;
    FreeVariable *variables = res->freeVariables();
    for (i = 0, num = res->numFreeVariables(); i < num; i++)
        variables[i] = FreeVariable(dummyAtom);

    HeapPtrFunction *functions = res->innerFunctions();
    for (i = 0, num = res->numInnerFunctions(); i < num; i++)
        functions[i].init(dummyFun);

    return res;
}






    // packed-word representation.
    uintptr_t bits_;

    static const uintptr_t KIND_MASK = 0x3;
    static const uintptr_t ALIASED_BIT = 0x4;
    static const uintptr_t NAME_MASK = ~(KIND_MASK | ALIASED_BIT);

  public:
    // A "binding" is a formal, 'var' (also a stand in for body-level 'let'
    // declarations), or 'const' declaration. A function's lexical scope is
    // composed of these three kinds of bindings.
    enum Kind { ARGUMENT, VARIABLE, CONSTANT };

    explicit Binding() : bits_(0) {}

    Binding(PropertyName *name, Kind kind, bool aliased) {
        JS_STATIC_ASSERT(CONSTANT <= KIND_MASK);
        JS_ASSERT((uintptr_t(name) & ~NAME_MASK) == 0);
        JS_ASSERT((uintptr_t(kind) & ~KIND_MASK) == 0);

{
    friend class BindingIter;
    friend class AliasedFormalIter;

    HeapPtrShape callObjShape_;
    uintptr_t bindingArrayAndFlag_;
    uint16_t numArgs_;
    uint16_t numBlockScoped_;
    uint16_t numBodyLevelLets_;
    uint16_t aliasedBodyLevelLetStart_;
    uint32_t numVars_;

#if JS_BITS_PER_WORD == 32
    // Bindings is allocated inline inside JSScript, which needs to be
    // gc::Cell aligned.
    uint32_t padding_;
#endif

    /*
     * During parsing, bindings are allocated out of a temporary LifoAlloc.
     * After parsing, a JSScript object is created and the bindings are
     * permanently transferred to it. On error paths, the JSScript object may
     * end up with bindings that still point to the (new released) LifoAlloc
     * memory. To avoid tracing these bindings during GC, we keep track of
     * whether the bindings are temporary or permanent in the low bit of
     * bindingArrayAndFlag_.

    Binding *bindingArray() const {
        return reinterpret_cast<Binding *>(bindingArrayAndFlag_ & ~TEMPORARY_STORAGE_BIT);
    }

    inline Bindings();

    /*
     * Initialize a Bindings with a pointer into temporary storage.
     * bindingArray must have length numArgs+numVars+numBodyLevelLets. Before
     * the temporary storage is release, switchToScriptStorage must be called,
     * providing a pointer into the Binding array stored in script->data.
     */
    static bool initWithTemporaryStorage(ExclusiveContext *cx, InternalBindingsHandle self,
                                         uint32_t numArgs, uint32_t numVars,
                                         uint32_t numBodyLevelLets, uint32_t numBlockScoped,
                                         Binding *bindingArray);

    // CompileScript parses and compiles one statement at a time, but the result
    // is one Script object.  There will be no vars or bindings, because those
    // go on the global, but there may be block-scoped locals, and the number of
    // block-scoped locals may increase as we parse more expressions.  This
    // helper updates the number of block scoped variables in a script as it is
    // being parsed.
    void updateNumBlockScoped(unsigned numBlockScoped) {


    /*
     * Clone srcScript's bindings (as part of js::CloneScript). dstScriptData
     * is the pointer to what will eventually be dstScript->data.
     */
    static bool clone(JSContext *cx, InternalBindingsHandle self, uint8_t *dstScriptData,
                      HandleScript srcScript);

    uint32_t numArgs() const { return numArgs_; }
    uint32_t numVars() const { return numVars_; }
    uint32_t numBodyLevelLets() const { return numBodyLevelLets_; }
    uint32_t numBlockScoped() const { return numBlockScoped_; }
    uint32_t numBodyLevelLocals() const { return numVars_ + numBodyLevelLets_; }
    uint32_t numLocals() const { return numVars() + numBodyLevelLets() + numBlockScoped(); }
    uint32_t aliasedBodyLevelLetStart() const { return aliasedBodyLevelLetStart_; }

    // Return the size of the bindingArray.
    uint32_t count() const { return numArgs() + numVars() + numBodyLevelLets(); }

    /* Return the initial shape of call objects created for this scope. */
    Shape *callObjShape() const { return callObjShape_; }

    /* Convenience method to get the var index of 'arguments'. */
    static uint32_t argumentsVarIndex(ExclusiveContext *cx, InternalBindingsHandle);

    /* Return whether the binding at bindingIndex is aliased. */

    void setColumn(size_t column) { column_ = column; }

    // The fixed part of a stack frame is comprised of vars (in function code)
    // and block-scoped locals (in all kinds of code).
    size_t nfixed() const {
        return function_ ? bindings.numLocals() : bindings.numBlockScoped();
    }

    // Number of fixed slots reserved for vars.  Only nonzero for function
    // code.
    size_t nfixedvars() const {
        return function_ ? bindings.numVars() : 0;
    }

    // Number of fixed slots reserved for body-level lets and vars. This value
    // minus nfixedvars() is the number of body-level lets. Only nonzero for
    // function code.
    size_t nbodyfixed() const {
        return function_ ? bindings.numBodyLevelLocals() : 0;
    }

    // Aliases for clarity when dealing with let slots.
    size_t fixedLetBegin() const {
        return nfixedvars();
    }

    size_t fixedLetEnd() const {
        return nfixed();
    }

    size_t nslots() const {
        return nslots_;
    }

    size_t staticLevel() const {
        return staticLevel_;
    }



        jsbytecode *pc = code();
        if (noScriptRval() && JSOp(*pc) == JSOP_FALSE)
            ++pc;
        return JSOp(*pc) == JSOP_RETRVAL;
    }

    bool varIsAliased(uint32_t varSlot);
    bool bodyLevelLocalIsAliased(uint32_t localSlot);
    bool formalIsAliased(unsigned argSlot);
    bool formalLivesInArgumentsObject(unsigned argSlot);

  private:
    /* Change this->stepMode to |newValue|. */
    void setNewStepMode(js::FreeOp *fop, uint32_t newValue);

    bool ensureHasDebugScript(JSContext *cx);

    unsigned frameIndex() const { JS_ASSERT(!done()); return p_ - begin_; }
    unsigned scopeSlot() const { JS_ASSERT(!done()); return slot_; }
};

// Information about a script which may be (or has been) lazily compiled to
// bytecode from its source.
class LazyScript : public gc::BarrieredCell<LazyScript>
{
  public:
    class FreeVariable
    {
        // Free variable names are possible tagged JSAtom *s.
        uintptr_t bits_;

        static const uintptr_t HOISTED_USE_BIT = 0x1;
        static const uintptr_t MASK = ~HOISTED_USE_BIT;

      public:
        explicit FreeVariable()
          : bits_(0)
        { }

        explicit FreeVariable(JSAtom *name)
          : bits_(uintptr_t(name))
        {
            // We rely on not requiring any write barriers so we can tag the
            // pointer. This code needs to change if we start allocating
            // JSAtoms inside the nursery.
            MOZ_ASSERT(!IsInsideNursery(name));
        }

        JSAtom *atom() const { return (JSAtom *)(bits_ & MASK); }
        void setIsHoistedUse() { bits_ |= HOISTED_USE_BIT; }
        bool isHoistedUse() const { return bool(bits_ & HOISTED_USE_BIT); }
    };

  private:
    // If non-nullptr, the script has been compiled and this is a forwarding
    // pointer to the result.
    HeapPtrScript script_;

    // Original function with which the lazy script is associated.
    HeapPtrFunction function_;

    // Function or block chain in which the script is nested, or nullptr.

        return (p_.version == JS_BIT(8) - 1) ? JSVERSION_UNKNOWN : JSVersion(p_.version);
    }

    void setParent(JSObject *enclosingScope, ScriptSourceObject *sourceObject);

    uint32_t numFreeVariables() const {
        return p_.numFreeVariables;
    }
    FreeVariable *freeVariables() {
        return (FreeVariable *)table_;
    }

    uint32_t numInnerFunctions() const {
        return p_.numInnerFunctions;
    }
    HeapPtrFunction *innerFunctions() {
        return (HeapPtrFunction *)&freeVariables()[numFreeVariables()];
    }

(-)a/js/src/tests/js1_7/block/order-of-operation.js (-1 / +2 lines)

Line	Link Here

Lines 80-107 function f6() {	Link Here

    var i=3;

    var i=3;

    for (let i=i;;) { if (i != 3) throw "f6(): fail 1"; i = 7; break; }

    for (let i=i;;) { if (i != 3) throw "f6(): fail 1"; i = 7; break; }

    if (i != 3) throw "f6(): fail 2";

    if (i != 3) throw "f6(): fail 2";

try

try

/*

  var rv = f1(5);

  var rv = f1(5);

  if (!isNaN(rv))

  if (!isNaN(rv))

    throw "f1(5):\n" +

    throw "f1(5):\n" +

      "  expected:  NaN\n" +

      "  expected:  NaN\n" +

      "  actual:    " + rv;

      "  actual:    " + rv;

  rv = f2(5);

  rv = f2(5);

  if (!isNaN(rv))

  if (!isNaN(rv))

    throw "f2(5):\n" +

    throw "f2(5):\n" +

      "  expected:  NaN\n" +

      "  expected:  NaN\n" +

      "  actual:    " + rv;

      "  actual:    " + rv;

/*

100

  rv = f3(8);

101

  rv = f3(8);

101

  if (rv != 9)

102

  if (rv != 9)

102

  throw "f3(8):\n" +

103

  throw "f3(8):\n" +

103

  "  expected:  9\n" +

104

  "  expected:  9\n" +

104

  "  actual:    " + rv;

105

  "  actual:    " + rv;

105

*/

106

*/

106

107

  rv = f4(13);

108

  rv = f4(13);

-      Line
+  Link Here
-       Lines 1-56
+  Link Here
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 411279;
+var summary = 'let declaration as direct child of switch body block';
+var actual = 'No Crash';
+var expect = 'No Crash';
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+  function f(x)
+  {
+    var value = '';
+    switch(x)
+    {
+    case 1:
+      value = "1 " + y;
+      break;
+    case 2:
+      let y = 42;
+      value = "2 " + y;
+      break;
+    default:
+      value = "default " + y;
+    }
+    return value;
+  }
+  expect = '1 undefined';
+  actual = f(1);
+  reportCompare(expect, actual, summary + ': f(1)');
+  expect = '2 42';
+  actual = f(2);
+  reportCompare(expect, actual, summary + ': f(2)');
+  expect = 'default undefined';
+  actual = f(3);
+  reportCompare(expect, actual, summary + ': f(3)');
+  exitFunc ('test');
+}





//-----------------------------------------------------------------------------

function test()
{
  enterFunc ('test');
  printBugNumber(BUGNUMBER);
  printStatus (summary);

  var f = function ([x]) { let y; }
  expect = 'function ([x]) { let y; }';
  actual = f + '';

  compareSource(expect, actual, summary);

  exitFunc ('test');
}

-      Line
+  Link Here
-       Lines 1-31
+  Link Here
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+// ------- Comment #103 From Jesse Ruderman
+  (function(a) { v = 5; let [v] = [3]; (function(){ v; })(); })();
+// Assertion failure: !(pn->pn_dflags & flag), at ../jsparse.h:638
+  reportCompare(expect, actual, summary);
+  exitFunc ('test');
+}





    macro(toJSON, toJSON, "toJSON") \
    macro(toLocaleString, toLocaleString, "toLocaleString") \
    macro(toSource, toSource, "toSource") \
    macro(toString, toString, "toString") \
    macro(toUTCString, toUTCString, "toUTCString") \
    macro(true, true_, "true") \
    macro(unescape, unescape, "unescape") \
    macro(uneval, uneval, "uneval") \
    macro(uninitialized, uninitialized, "uninitialized") \
    macro(uint8, uint8, "uint8") \
    macro(uint8Clamped, uint8Clamped, "uint8Clamped") \
    macro(uint16, uint16, "uint16") \
    macro(uint32, uint32, "uint32") \
    macro(unsized, unsized, "unsized") \
    macro(unwatch, unwatch, "unwatch") \
    macro(url, url, "url") \
    macro(usage, usage, "usage") \






            vp.setObject(*dobj);
        }
    } else if (vp.isMagic()) {
        RootedObject optObj(cx, NewBuiltinClassInstance(cx, &JSObject::class_));
        if (!optObj)
            return false;

        // We handle three sentinel values: missing arguments (overloading
        // JS_OPTIMIZED_ARGUMENTS), optimized out slots (JS_OPTIMIZED_OUT),
        // and uninitialized bindings (JS_UNINITIALIZED_LET).
        //
        // Other magic values should not have escaped.
        PropertyName *name;
        switch (vp.whyMagic()) {
          case JS_OPTIMIZED_ARGUMENTS: name = cx->names().missingArguments; break;
          case JS_OPTIMIZED_OUT:       name = cx->names().optimizedOut; break;
          case JS_UNINITIALIZED_LET:   name = cx->names().uninitialized; break;
          default: MOZ_CRASH("Unsupported magic value escaped to Debugger");
        }

        RootedValue trueVal(cx, BooleanValue(true));
        if (!JSObject::defineProperty(cx, optObj, name, trueVal))
            return false;

        vp.setObject(*optObj);
    } else if (!cx->compartment()->wrap(cx, vp)) {





     * wrapper for it. Otherwise this is the same as JSCompartment::wrap.
     *
     * If *vp is a magic JS_OPTIMIZED_OUT value, this produces a plain object
     * of the form { optimizedOut: true }.
     *
     * If *vp is a magic JS_OPTIMIZED_ARGUMENTS value signifying missing
     * arguments, this produces a plain object of the form { missingArguments:
     * true }.
     *
     * If *vp is a magic JS_UNINITIALIZED_LET value signifying an unaccessible
     * uninitialized binding, this produces a plain object of the form
     * { uninitialized: true }.
     */
    bool wrapDebuggeeValue(JSContext *cx, MutableHandleValue vp);

    /*
     * Unwrap a Debug.Object, without rewrapping it for any particular debuggee
     * compartment.
     *
     * Preconditions: cx is in the debugger compartment. *vp is a value in that





#include "jit/Ion.h"
#include "vm/ArgumentsObject.h"
#include "vm/ForkJoin.h"

#include "jsatominlines.h"
#include "jsinferinlines.h"
#include "jsobjinlines.h"

#include "vm/ScopeObject-inl.h"
#include "vm/Stack-inl.h"
#include "vm/String-inl.h"

namespace js {

inline bool
ComputeThis(JSContext *cx, AbstractFramePtr frame)
{

            args[1] = ObjectValue(frame.argsObj());
        }
    }

    return true;
}

/*
 * Per ES6, 'let' declarations may not be accessed in any fashion until they
 * are initialized (i.e., until the actual declaring statement is
 * executed). The various LET opcodes need to check if the slot is an
 * uninitialized let declaration, represented by the magic value
 * JS_UNINITIALIZED_LET.
 */
static inline bool
IsUninitializedLet(const Value &val)
{
    // Use whyMagic here because JS_OPTIMIZED_ARGUMENTS could flow into here.
    return val.isMagic() && val.whyMagic() == JS_UNINITIALIZED_LET;
}

static inline bool
IsUninitializedLetSlot(HandleObject obj, HandleShape shape)
{
    if (obj->is<DynamicWithObject>())
        return false;
    if (!shape || IsImplicitDenseOrTypedArrayElement(shape) || !shape->hasSlot())
        return false;
    return IsUninitializedLet(obj->nativeGetSlot(shape->slot()));
}

static inline bool
CheckUninitializedLet(JSContext *cx, PropertyName *name_, HandleValue val)
{
    if (IsUninitializedLet(val)) {
        RootedPropertyName name(cx, name_);
        ReportUninitializedLet(cx, name);
        return false;
    }
    return true;
}

static inline bool
CheckUninitializedLet(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue val)
{
    if (IsUninitializedLet(val)) {
        ReportUninitializedLet(cx, script, pc);
        return false;
    }
    return true;
}

/*
 * Return an object on which we should look for the properties of |value|.
 * This helps us implement the custom [[Get]] method that ES5's GetValue
 * algorithm uses for primitive values, without actually constructing the
 * temporary object that the specification does.
 *
 * For objects, return the object itself. For string, boolean, and number
 * primitive values, return the appropriate constructor's prototype. For
 * undefined and null, throw an error and return nullptr, attributing the


inline bool
SetIntrinsicOperation(JSContext *cx, JSScript *script, jsbytecode *pc, HandleValue val)
{
    RootedPropertyName name(cx, script->getName(pc));
    return cx->global()->setIntrinsicValue(cx, name, val);
}

inline void
SetAliasedVarOperation(JSContext *cx, JSScript *script, jsbytecode *pc,
                       ScopeObject &obj, ScopeCoordinate sc, const Value &val,
                       bool checkUninitializedLet)
{
    MOZ_ASSERT_IF(checkUninitializedLet, !IsUninitializedLet(obj.aliasedVar(sc)));

    // Avoid computing the name if no type updates are needed, as this may be
    // expensive on scopes with large numbers of variables.
    PropertyName *name = (obj.hasSingletonType() && !obj.hasLazyType())
                         ? ScopeCoordinateName(cx->runtime()->scopeCoordinateNameCache, script, pc)
                         : nullptr;

    obj.setAliasedVar(cx, sc, name, val);
}

inline bool
SetNameOperation(JSContext *cx, JSScript *script, jsbytecode *pc, HandleObject scope,
                 HandleValue val)
{
    JS_ASSERT(*pc == JSOP_SETNAME || *pc == JSOP_SETGNAME);
    JS_ASSERT_IF(*pc == JSOP_SETGNAME, scope == cx->global());

    bool strict = script->strict();





     */
    if (IsGlobalOp(JSOp(*pc)))
        obj = &obj->global();

    Shape *shape = nullptr;
    JSObject *scope = nullptr, *pobj = nullptr;
    if (LookupNameNoGC(cx, name, obj, &scope, &pobj, &shape)) {
        if (FetchNameNoGC(pobj, shape, vp))
            return CheckUninitializedLet(cx, name, vp);
    }

    RootedObject objRoot(cx, obj), scopeRoot(cx), pobjRoot(cx);
    RootedPropertyName nameRoot(cx, name);
    RootedShape shapeRoot(cx);

    if (!LookupName(cx, nameRoot, objRoot, &scopeRoot, &pobjRoot, &shapeRoot))
        return false;

    /* Kludge to allow (typeof foo == "undefined") tests. */
    JSOp op2 = JSOp(pc[JSOP_NAME_LENGTH]);
    if (op2 == JSOP_TYPEOF) {
        if (!FetchName<true>(cx, scopeRoot, pobjRoot, nameRoot, shapeRoot, vp))
            return false;
    } else {
        if (!FetchName<false>(cx, scopeRoot, pobjRoot, nameRoot, shapeRoot, vp))
            return false;
    }

    // NAME operations are the slow paths already, so unconditionally check
    // for uninitialized lets.
    return CheckUninitializedLet(cx, nameRoot, vp);
}

static inline bool
SetPropertyOperation(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue lval,
                     HandleValue rval)
{
    JS_ASSERT(*pc == JSOP_SETPROP);


    DynamicWithObject *withobj = DynamicWithObject::create(cx, obj, scopeChain, staticWith);
    if (!withobj)
        return false;

    frame.pushOnScopeChain(*withobj);
    return true;
}

static void
PopScope(JSContext *cx, ScopeIter &si)
{
    switch (si.type()) {
      case ScopeIter::Block:
        if (cx->compartment()->debugMode())
            DebugScopes::onPopBlock(cx, si);
        if (si.staticBlock().needsClone())
            si.frame().popBlock(cx);
        break;
      case ScopeIter::With:
        si.frame().popWith(cx);
        break;
      case ScopeIter::Call:
      case ScopeIter::StrictEvalScope:
        break;
    }
}

// Unwind scope chain and iterator to match the static scope corresponding to
// the given bytecode position.
void
js::UnwindScope(JSContext *cx, ScopeIter &si, jsbytecode *pc)
{
    if (si.done())
        return;

    Rooted<NestedScopeObject *> staticScope(cx, si.frame().script()->getStaticScope(pc));

    for (; si.staticScope() != staticScope; ++si)
        PopScope(cx, si);
}

// Unwind all scopes. This is needed because block scopes may cover the
// first bytecode at a script's main(). e.g.,
//
//     function f() { { let i = 0; } }
//
// will have no pc location distinguishing the first block scope from the
// outermost function scope.
void
js::UnwindAllScopes(JSContext *cx, ScopeIter &si)
{
    for (; !si.done(); ++si)
        PopScope(cx, si);
}

// Compute the pc needed to unwind the scope to the beginning of a try
// block. We cannot unwind to *after* the JSOP_TRY, because that might be the
// first opcode of an inner scope, with the same problem as above. e.g.,
//
// try { { let x; } }
//
// will have no pc location distinguishing the try block scope from the inner
// let block scope.
jsbytecode *
js::UnwindScopeToTryPc(JSScript *script, JSTryNote *tn)
{
    return script->main() + tn->start - js_CodeSpec[JSOP_TRY].length;
}

static void
ForcedReturn(JSContext *cx, ScopeIter &si, InterpreterRegs &regs)
{
    UnwindAllScopes(cx, si);
    regs.setToEndOfScript();
}

static void
ForcedReturn(JSContext *cx, InterpreterRegs &regs)
{
    ScopeIter si(regs.fp(), regs.pc, cx);
    ForcedReturn(cx, si, regs);

                MOZ_CRASH("Invalid trap status");
            }
        }

        RootedValue exception(cx);
        for (TryNoteIter tni(cx, regs); !tni.done(); ++tni) {
            JSTryNote *tn = *tni;

            // Unwind the scope to the beginning of the JSOP_TRY.
            UnwindScope(cx, si, UnwindScopeToTryPc(regs.fp()->script(), tn));

            /*
             * Set pc to the first bytecode after the the try note to point
             * to the beginning of catch or finally or to [enditer] closing
             * the for-in loop.
             */
            regs.pc = regs.fp()->script()->main() + tn->start + tn->length;
            regs.sp = regs.spForStackDepth(tn->stackDepth);

CASE(JSOP_UNUSED102)
CASE(JSOP_UNUSED103)
CASE(JSOP_UNUSED104)
CASE(JSOP_UNUSED105)
CASE(JSOP_UNUSED107)
CASE(JSOP_UNUSED124)
CASE(JSOP_UNUSED125)
CASE(JSOP_UNUSED126)
CASE(JSOP_UNUSED138)
CASE(JSOP_UNUSED139)
CASE(JSOP_UNUSED140)
CASE(JSOP_UNUSED141)
CASE(JSOP_UNUSED142)
CASE(JSOP_UNUSED146)
CASE(JSOP_UNUSED147)
CASE(JSOP_UNUSED148)
CASE(JSOP_BACKPATCH)
CASE(JSOP_UNUSED150)
CASE(JSOP_UNUSED156)
CASE(JSOP_UNUSED157)

    RootedObject &scopeChain = rootObject0;
    scopeChain = REGS.fp()->scopeChain();

    RootedPropertyName &name = rootName0;
    name = script->getName(REGS.pc);

    /* Assigning to an undeclared name adds a property to the global object. */
    RootedObject &scope = rootObject1;
    RootedShape &shape = rootShape0;
    if (!LookupNameUnqualified(cx, name, scopeChain, &scope, &shape))
        goto error;

    // ES6 lets cannot be accessed until initialized. NAME operations, being
    // the slow paths already, unconditionally check for uninitialized
    // lets. The error, however, is thrown after evaluating the RHS in
    // assignments. Thus if the LHS resolves to an uninitialized let, return a
    // nullptr scope.
    if (IsUninitializedLetSlot(scope, shape))
        PUSH_NULL();
    else
        PUSH_OBJECT(*scope);
}
END_CASE(JSOP_BINDNAME)

#define BITWISE_OP(OP)                                                        \
    JS_BEGIN_MACRO                                                            \
        int32_t i, j;                                                         \
        if (!ToInt32(cx, REGS.stackHandleAt(-2), &i))                         \
            goto error;                                                       \

    REGS.sp--;
}
END_CASE(JSOP_SETINTRINSIC)

CASE(JSOP_SETGNAME)
CASE(JSOP_SETNAME)
{
    RootedObject &scope = rootObject0;
    scope = REGS.sp[-2].toObjectOrNull();

    // A nullptr scope is pushed if the name is an uninitialized let. See
    // CASE(JSOP_BINDNAME).
    if (!scope) {
        RootedPropertyName &name = rootName0;
        name = script->getName(REGS.pc);
        ReportUninitializedLet(cx, name);
        goto error;
    }

    HandleValue value = REGS.stackHandleAt(-1);

    if (!SetNameOperation(cx, script, REGS.pc, scope, value))
        goto error;

    REGS.sp[-2] = REGS.sp[-1];
    REGS.sp--;

{
    RootedPropertyName &name = rootName0;
    name = script->getName(REGS.pc);

    RootedObject &scopeObj = rootObject0;
    scopeObj = REGS.fp()->scopeChain();

    RootedObject &scope = rootObject1;
    RootedShape &shape = rootShape0;
    if (!LookupNameWithGlobalDefault(cx, name, scopeObj, &scope, &shape))
        goto error;

    RootedValue &v = rootValue0;
    if (!ComputeImplicitThis(cx, scope, &v))
        goto error;
    PUSH_COPY(v);
}
END_CASE(JSOP_IMPLICITTHIS)

        goto error;
    PUSH_COPY(ObjectValue(*rest));
}
END_CASE(JSOP_REST)

CASE(JSOP_GETALIASEDVAR)
{
    ScopeCoordinate sc = ScopeCoordinate(REGS.pc);
    RootedValue &val = rootValue0;
    val = REGS.fp()->aliasedVarScope(sc).aliasedVar(sc);
    MOZ_ASSERT(!IsUninitializedLet(val));
    PUSH_COPY(val);
    TypeScript::Monitor(cx, script, REGS.pc, REGS.sp[-1]);
}
END_CASE(JSOP_GETALIASEDVAR)

CASE(JSOP_SETALIASEDVAR)
{
    ScopeCoordinate sc = ScopeCoordinate(REGS.pc);
    ScopeObject &obj = REGS.fp()->aliasedVarScope(sc);
    SetAliasedVarOperation(cx, script, REGS.pc, obj, sc, REGS.sp[-1],
                           /* checkUninitializedLet = */ true);
    // expensive on scopes with large numbers of variables.
    PropertyName *name = (obj.hasSingletonType() && !obj.hasLazyType())
                         ? ScopeCoordinateName(cx->runtime()->scopeCoordinateNameCache, script, REGS.pc)
                         : nullptr;

    obj.setAliasedVar(cx, sc, name, REGS.sp[-1]);
}
END_CASE(JSOP_SETALIASEDVAR)

CASE(JSOP_CHECKLET)
{
    uint32_t i = GET_LOCALNO(REGS.pc);
    RootedValue &val = rootValue0;
    val = REGS.fp()->unaliasedLocal(i);
    if (!CheckUninitializedLet(cx, script, REGS.pc, val))
        goto error;
}
END_CASE(JSOP_CHECKLET)

CASE(JSOP_INITLET)
{
    uint32_t i = GET_LOCALNO(REGS.pc);
    REGS.fp()->unaliasedLocal(i) = REGS.sp[-1];
}
END_CASE(JSOP_INITLET)

CASE(JSOP_CHECKALIASEDLET)
{
    ScopeCoordinate sc = ScopeCoordinate(REGS.pc);
    RootedValue &val = rootValue0;
    val = REGS.fp()->aliasedVarScope(sc).aliasedVar(sc);
    if (!CheckUninitializedLet(cx, script, REGS.pc, val))
        goto error;
}
END_CASE(JSOP_CHECKALIASEDLET)

CASE(JSOP_INITALIASEDLET)
{
    ScopeCoordinate sc = ScopeCoordinate(REGS.pc);
    ScopeObject &obj = REGS.fp()->aliasedVarScope(sc);
    SetAliasedVarOperation(cx, script, REGS.pc, obj, sc, REGS.sp[-1],
                           /* checkUninitializedLet = */ false);
}
END_CASE(JSOP_INITALIASEDLET)

CASE(JSOP_GETARG)
{
    unsigned i = GET_ARGNO(REGS.pc);
    if (script->argsObjAliasesFormals())
        PUSH_COPY(REGS.fp()->argsObj().arg(i));
    else
        PUSH_COPY(REGS.fp()->unaliasedFormal(i));
}

        REGS.fp()->unaliasedFormal(i) = REGS.sp[-1];
}
END_CASE(JSOP_SETARG)

CASE(JSOP_GETLOCAL)
{
    uint32_t i = GET_LOCALNO(REGS.pc);
    PUSH_COPY_SKIP_CHECK(REGS.fp()->unaliasedLocal(i));
    MOZ_ASSERT(!IsUninitializedLet(REGS.sp[-1]));

    /*
     * Skip the same-compartment assertion if the local will be immediately
     * popped. We do not guarantee sync for dead locals when coming in from the
     * method JIT, and a GETLOCAL followed by POP is not considered to be
     * a use of the variable.
     */
    if (REGS.pc[JSOP_GETLOCAL_LENGTH] != JSOP_POP)
        assertSameCompartmentDebugOnly(cx, REGS.sp[-1]);
}
END_CASE(JSOP_GETLOCAL)

CASE(JSOP_SETLOCAL)
{
    uint32_t i = GET_LOCALNO(REGS.pc);
    MOZ_ASSERT(!IsUninitializedLet(REGS.fp()->unaliasedLocal(i)));
    REGS.fp()->unaliasedLocal(i) = REGS.sp[-1];
}
END_CASE(JSOP_SETLOCAL)

CASE(JSOP_DEFCONST)
CASE(JSOP_DEFVAR)
{
    /* ES5 10.5 step 8 (with subsequent errata). */

    return true;
}

bool
js::ImplicitThisOperation(JSContext *cx, HandleObject scopeObj, HandlePropertyName name,
                          MutableHandleValue res)
{
    RootedObject obj(cx);
    RootedShape shape(cx);
    if (!LookupNameWithGlobalDefault(cx, name, scopeObj, &obj, &shape))
        return false;

    return ComputeImplicitThis(cx, obj, res);
}

bool
js::RunOnceScriptPrologue(JSContext *cx, HandleScript script)
{

      default:
        MOZ_CRASH("bad spread opcode");
    }

    res.set(args.rval());
    TypeScript::Monitor(cx, script, pc, res);
    return true;
}

void
js::ReportUninitializedLet(JSContext *cx, HandlePropertyName name)
{
    JSAutoByteString printable;
    if (AtomToPrintableString(cx, name, &printable)) {
        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_UNINITIALIZED_LET,
                             printable.ptr());
    }
}

void
js::ReportUninitializedLet(JSContext *cx, HandleScript script, jsbytecode *pc)
{
    RootedPropertyName name(cx);

    if (JSOp(*pc) == JSOP_CHECKLET) {
        uint32_t slot = GET_LOCALNO(pc);

        // First search for a name among body-level lets.
        for (BindingIter bi(script); bi; bi++) {
            if (bi->kind() != Binding::ARGUMENT && bi.frameIndex() == slot) {
                name = bi->name();
                break;
            }
        }

        // Failing that, it must be a block-local let.
        if (!name) {
            // Skip to the right scope.
            Rooted<NestedScopeObject *> scope(cx, script->getStaticScope(pc));
            MOZ_ASSERT(scope && scope->is<StaticBlockObject>());
            Rooted<StaticBlockObject *> block(cx, &scope->as<StaticBlockObject>());
            while (slot < block->localOffset())
                block = &block->enclosingNestedScope()->as<StaticBlockObject>();

            // Translate the frame slot to the block slot, then find the name
            // of the slot.
            uint32_t blockSlot = block->localIndexToSlot(slot);
            RootedShape shape(cx, block->lastProperty());
            Shape::Range<CanGC> r(cx, shape);
            while (r.front().slot() != blockSlot)
                r.popFront();
            jsid id = r.front().propidRaw();
            MOZ_ASSERT(JSID_IS_ATOM(id));
            name = JSID_TO_ATOM(id)->asPropertyName();
        }
    } else {
        MOZ_ASSERT(JSOp(*pc) == JSOP_CHECKALIASEDLET);
        name = ScopeCoordinateName(cx->runtime()->scopeCoordinateNameCache, script, pc);
    }

    ReportUninitializedLet(cx, name);
}

void
js::ReportUninitializedLet(JSContext *cx, HandleScript script, jsbytecode *pc, ScopeCoordinate sc)
{
    RootedPropertyName name(cx, ScopeCoordinateName(cx->runtime()->scopeCoordinateNameCache,
                                                    script, pc));
    ReportUninitializedLet(cx, name);
}





extern bool
HasInstance(JSContext *cx, HandleObject obj, HandleValue v, bool *bp);

// Unwind scope chain and iterator to match the static scope corresponding to
// the given bytecode position.
extern void
UnwindScope(JSContext *cx, ScopeIter &si, jsbytecode *pc);

// Unwind all scopes.
extern void
UnwindAllScopes(JSContext *cx, ScopeIter &si);

// Compute the pc needed to unwind the scope to the beginning of the block
// pointed to by the try note.
extern jsbytecode *
UnwindScopeToTryPc(JSScript *script, JSTryNote *tn);

/*
 * Unwind for an uncatchable exception. This means not running finalizers, etc;
 * just preserving the basic engine stack invariants.
 */
extern void
UnwindForUncatchableException(JSContext *cx, const InterpreterRegs &regs);

extern bool

inline bool
SetConstOperation(JSContext *cx, HandleObject varobj, HandlePropertyName name, HandleValue rval)
{
    return JSObject::defineProperty(cx, varobj, name, rval,
                                    JS_PropertyStub, JS_StrictPropertyStub,
                                    JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_READONLY);
}

void
ReportUninitializedLet(JSContext *cx, HandlePropertyName name);

void
ReportUninitializedLet(JSContext *cx, HandleScript script, jsbytecode *pc);

void
ReportUninitializedLet(JSContext *cx, HandleScript script, jsbytecode *pc, ScopeCoordinate sc);

}  /* namespace js */

#endif /* vm_Interpreter_h */





     * Sets aliased variable as the top of stack value.
     *   Category: Variables and Scopes
     *   Type: Aliased Variables
     *   Operands: uint8_t hops, uint24_t slot
     *   Stack: v => v
     */ \
    macro(JSOP_SETALIASEDVAR, 137,"setaliasedvar",NULL,      5,  1,  1,  JOF_SCOPECOORD|JOF_NAME|JOF_SET|JOF_DETECTING) \
    \
    /*
     * Checks if the value of the local variable is the JS_UNINITIALIZED_LET
     * magic, throwing an error if so.
     *   Category: Variables and Scopes
     *   Type: Local Variables
     *   Operands: uint32_t localno
     *   Stack: =>
     */ \
    macro(JSOP_CHECKLET,        138, "checklet",        NULL, 4,  0,  0, JOF_LOCAL|JOF_NAME) \
    /*
     * Initializes an uninitialized local let binding with the top of stack
     * value.
     *   Category: Variables and Scopes
     *   Type: Local Variables
     *   Operands: uint32_t localno
     *   Stack: v => v
     */ \
    macro(JSOP_INITLET,         139, "initlet",         NULL, 4,  1,  1, JOF_LOCAL|JOF_NAME|JOF_SET|JOF_DETECTING) \
    /*
     * Checks if the value of the aliased variable is the JS_UNINITIALIZED_LET
     * magic, throwing an error if so.
     *   Category: Variables and Scopes
     *   Type: Aliased Variables
     *   Operands: uint8_t hops, uint24_t slot
     *   Stack: =>
     */ \
    macro(JSOP_CHECKALIASEDLET, 140, "checkaliasedlet", NULL, 5,  0,  0, JOF_SCOPECOORD|JOF_NAME) \
    /*
     * Initializes an uninitialized aliased let binding with the top of stack
     * value.
     *   Category: Variables and Scopes
     *   Type: Aliased Variables
     *   Operands: uint8_t hops, uint24_t slot
     *   Stack: v => v
     */ \
    macro(JSOP_INITALIASEDLET,  141, "initaliasedlet",  NULL, 5,  1,  1, JOF_SCOPECOORD|JOF_NAME|JOF_SET|JOF_DETECTING) \
    /* Unused */ \
    macro(JSOP_UNUSED142,     142,"unused142", NULL,      1,  0,  0,  JOF_BYTE) \
    \
    /*
     * Pushes the value of the intrinsic onto the stack.
     *
     * Intrinsic names are emitted instead of JSOP_*NAME ops when the
     * 'CompileOptions' flag 'selfHostingMode' is set.
     *
     * They are used in self-hosted code to access other self-hosted values and





inline void
CallObject::setAliasedVarFromArguments(JSContext *cx, const Value &argsValue, jsid id, const Value &v)
{
    setSlot(argsValue.magicUint32(), v);
    if (hasSingletonType())
        types::AddTypePropertyId(cx, this, id, v);
}

inline void
CallObject::setAliasedLetsToThrowOnTouch(JSScript *script)
{
    uint32_t aliasedLetStart = script->bindings.aliasedBodyLevelLetStart();
    uint32_t aliasedLetEnd = numFixedSlots();
    for (uint32_t slot = aliasedLetStart; slot < aliasedLetEnd; slot++)
        initFixedSlot(slot, MagicValue(JS_UNINITIALIZED_LET));
}

template <AllowGC allowGC>
inline bool
StaticScopeIter<allowGC>::done() const
{
    return !obj;
}

template <AllowGC allowGC>





{
    gc::InitialHeap heap = script->treatAsRunOnce() ? gc::TenuredHeap : gc::DefaultHeap;
    CallObject *callobj = CallObject::createTemplateObject(cx, script, heap);
    if (!callobj)
        return nullptr;

    callobj->as<ScopeObject>().setEnclosingScope(enclosing);
    callobj->initFixedSlot(CALLEE_SLOT, ObjectOrNullValue(callee));
    callobj->setAliasedLetsToThrowOnTouch(script);

    if (script->treatAsRunOnce()) {
        Rooted<CallObject*> ncallobj(cx, callobj);
        if (!JSObject::setSingletonType(cx, ncallobj))
            return nullptr;
        return ncallobj;
    }


    bool handleUnaliasedAccess(JSContext *cx, Handle<DebugScopeObject*> debugScope,
                               Handle<ScopeObject*> scope, jsid id, Action action,
                               MutableHandleValue vp, AccessResult *accessResult) const
    {
        JS_ASSERT(&debugScope->scope() == scope);
        *accessResult = ACCESS_GENERIC;
        ScopeIterVal *maybeLiveScope = DebugScopes::hasLiveScope(*scope);

        /* Handle unaliased formals, vars, lets, and consts at function scope. */
        if (scope->is<CallObject>() && !scope->as<CallObject>().isForEval()) {
            CallObject &callobj = scope->as<CallObject>();
            RootedScript script(cx, callobj.callee().nonLazyScript());
            if (!script->ensureHasTypes(cx) || !script->ensureHasAnalyzedArgsUsage(cx))
                return false;

            Bindings &bindings = script->bindings;
            BindingIter bi(script);
            while (bi && NameToId(bi->name()) != id)
                bi++;
            if (!bi)
                return true;

            if (bi->kind() == Binding::VARIABLE || bi->kind() == Binding::CONSTANT) {
                uint32_t i = bi.frameIndex();
                if (script->bodyLevelLocalIsAliased(i))
                    return true;

                if (maybeLiveScope) {
                    AbstractFramePtr frame = maybeLiveScope->frame();
                    if (action == GET)
                        vp.set(frame.unaliasedLocal(i));
                    else
                        frame.unaliasedLocal(i) = vp;
                } else if (JSObject *snapshot = debugScope->maybeSnapshot()) {
                    if (action == GET)
                        vp.set(snapshot->getDenseElement(bindings.numArgs() + i));
                    else
                        snapshot->setDenseElement(bindings.numArgs() + i, vp);
                } else {
                    /* The unaliased value has been lost to the debugger. */
                    if (action == GET) {






    inline ScopeCoordinate() {}

    void setHops(uint32_t hops) { JS_ASSERT(hops < SCOPECOORD_HOPS_LIMIT); hops_ = hops; }
    void setSlot(uint32_t slot) { JS_ASSERT(slot < SCOPECOORD_SLOT_LIMIT); slot_ = slot; }

    uint32_t hops() const { JS_ASSERT(hops_ < SCOPECOORD_HOPS_LIMIT); return hops_; }
    uint32_t slot() const { JS_ASSERT(slot_ < SCOPECOORD_SLOT_LIMIT); return slot_; }

    bool operator==(const ScopeCoordinate &rhs) const {
        return hops() == rhs.hops() && slot() == rhs.slot();
    }
};

/*
 * Return a shape representing the static scope containing the variable
 * accessed by the ALIASEDVAR op at 'pc'.
 */
extern Shape *
ScopeCoordinateToStaticScopeShape(JSScript *script, jsbytecode *pc);


class CallObject : public ScopeObject
{
    static const uint32_t CALLEE_SLOT = 1;

    static CallObject *
    create(JSContext *cx, HandleScript script, HandleObject enclosing, HandleFunction callee);

    inline void setAliasedLetsToThrowOnTouch(JSScript *script);

  public:
    static const Class class_;

    /* These functions are internal and are exposed only for JITs. */

    /*
     * Construct a bare-bones call object given a shape and a non-singleton
     * type.  The call object must be further initialized to be usable.





    exec.fun = &callee;
    u.nactual = nactual;
    scopeChain_ = callee.environment();
    prev_ = prev;
    prevpc_ = prevpc;
    prevsp_ = prevsp;

    initVarsToUndefined();
    setLetsToThrowOnTouch();
}

inline void
InterpreterFrame::initVarsToUndefined()
{
    SetValueRangeToUndefined(slots(), script()->nfixed());
}

inline void
InterpreterFrame::setLetsToThrowOnTouch()
{
    // 'let' declaration throw ReferenceErrors if they are used before
    // initialization. See ES6 8.1.1.1.6.
    for (size_t slot = script()->fixedLetBegin(), end = script()->fixedLetEnd(); slot < end; slot++)
        slots()[slot].setMagic(JS_UNINITIALIZED_LET);
}

inline Value &
InterpreterFrame::unaliasedVar(uint32_t i, MaybeCheckAliasing checkAliasing)
{
    JS_ASSERT_IF(checkAliasing, !script()->varIsAliased(i));
    JS_ASSERT(i < script()->nfixedvars());
    return slots()[i];
}







    size_t nfixed = script()->nfixed();
    size_t nlivefixed;

    if (staticScope) {
        StaticBlockObject &blockObj = staticScope->as<StaticBlockObject>();
        nlivefixed = blockObj.localOffset() + blockObj.numVariables();
    } else {
        nlivefixed = script()->nbodyfixed();
    }

    if (nfixed == nlivefixed) {
        // All locals are live.
        markValues(trc, 0, sp - slots());
    } else {
        // Mark operand stack.
        markValues(trc, nfixed, sp - slots());

    uint8_t *buffer = allocateFrame(cx, sizeof(InterpreterFrame) + nvars * sizeof(Value));
    if (!buffer)
        return nullptr;

    InterpreterFrame *fp = reinterpret_cast<InterpreterFrame *>(buffer + 2 * sizeof(Value));
    fp->mark_ = mark;
    fp->initExecuteFrame(cx, script, evalInFrame, thisv, *scopeChain, type);
    fp->initVarsToUndefined();
    fp->setLetsToThrowOnTouch();

    return fp;
}

/*****************************************************************************/

/* MSVC PGO causes xpcshell startup crashes. */
#if defined(_MSC_VER)






    bool prologue(JSContext *cx);
    void epilogue(JSContext *cx);

    bool initFunctionScopeObjects(JSContext *cx);

    /* Initialize local variables of newly-pushed frame. */
    void initVarsToUndefined();
    void setLetsToThrowOnTouch();

    /*
     * Stack frame type
     *
     * A stack frame may have one of three types, which determines which
     * members of the frame may be accessed and other invariants:
     *
     *  global frame:   execution of global code or an eval in global code

Return to bug 1001090