1  /*
  2   * Copyright (C) 2014-2019 Apple Inc. All rights reserved.
  3   *
  4   * Redistribution and use in source and binary forms, with or without
  5   * modification, are permitted provided that the following conditions
  6   * are met:
  7   * 1. Redistributions of source code must retain the above copyright
  8   *    notice, this list of conditions and the following disclaimer.
  9   * 2. Redistributions in binary form must reproduce the above copyright
 10   *    notice, this list of conditions and the following disclaimer in the
 11   *    documentation and/or other materials provided with the distribution.
 12   *
 13   * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
 14   * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 15   * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 16   * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
 17   * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 18   * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 19   * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 20   * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 21   * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 22   * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 23   * THE POSSIBILITY OF SUCH DAMAGE.
 24   */
 25  
 26  #include "config.h"
 27  #include "JSPropertyNameEnumerator.h"
 28  
 29  #include "JSObjectInlines.h"
 30  
 31  namespace JSC {
 32  
 33  const ClassInfo JSPropertyNameEnumerator::s_info = { "JSPropertyNameEnumerator", nullptr, nullptr, nullptr, CREATE_METHOD_TABLE(JSPropertyNameEnumerator) };
 34  
 35  JSPropertyNameEnumerator* JSPropertyNameEnumerator::create(VM& vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, PropertyNameArray&& propertyNames)
 36  {
 37      unsigned propertyNamesSize = propertyNames.size();
 38      unsigned propertyNamesBufferSizeInBytes = (Checked<unsigned>(propertyNamesSize) * sizeof(WriteBarrier<JSString>)).unsafeGet();
 39      WriteBarrier<JSString>* propertyNamesBuffer = nullptr;
 40      if (propertyNamesBufferSizeInBytes) {
 41          propertyNamesBuffer = static_cast<WriteBarrier<JSString>*>(vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, propertyNamesBufferSizeInBytes, nullptr, AllocationFailureMode::Assert));
 42          for (unsigned i = 0; i < propertyNamesSize; ++i)
 43              propertyNamesBuffer[i].clear();
 44      }
 45      JSPropertyNameEnumerator* enumerator = new (NotNull, allocateCell<JSPropertyNameEnumerator>(vm.heap)) JSPropertyNameEnumerator(vm, structure, indexedLength, numberStructureProperties, propertyNamesBuffer, propertyNamesSize);
 46      enumerator->finishCreation(vm, propertyNames.releaseData());
 47      return enumerator;
 48  }
 49  
 50  JSPropertyNameEnumerator::JSPropertyNameEnumerator(VM& vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, WriteBarrier<JSString>* propertyNamesBuffer, unsigned propertyNamesSize)
 51      : JSCell(vm, vm.propertyNameEnumeratorStructure.get())
 52      , m_propertyNames(vm, this, propertyNamesBuffer)
 53      , m_cachedStructureID(structure ? structure->id() : 0)
 54      , m_indexedLength(indexedLength)
 55      , m_endStructurePropertyIndex(numberStructureProperties)
 56      , m_endGenericPropertyIndex(propertyNamesSize)
 57      , m_cachedInlineCapacity(structure ? structure->inlineCapacity() : 0)
 58  {
 59  }
 60  
 61  void JSPropertyNameEnumerator::finishCreation(VM& vm, RefPtr<PropertyNameArrayData>&& identifiers)
 62  {
 63      Base::finishCreation(vm);
 64  
 65      PropertyNameArrayData::PropertyNameVector& vector = identifiers->propertyNameVector();
 66      ASSERT(m_endGenericPropertyIndex == vector.size());
 67      for (unsigned i = 0; i < vector.size(); ++i) {
 68          const Identifier& identifier = vector[i];
 69          m_propertyNames.get()[i].set(vm, this, jsString(vm, identifier.string()));
 70      }
 71  }
 72  
 73  void JSPropertyNameEnumerator::visitChildren(JSCell* cell, SlotVisitor& visitor)
 74  {
 75      JSPropertyNameEnumerator* thisObject = jsCast<JSPropertyNameEnumerator*>(cell);
 76      ASSERT_GC_OBJECT_INHERITS(thisObject, info());
 77      Base::visitChildren(cell, visitor);
 78      if (auto* propertyNames = thisObject->m_propertyNames.get()) {
 79          visitor.markAuxiliary(propertyNames);
 80          visitor.append(propertyNames, propertyNames + thisObject->sizeOfPropertyNames());
 81      }
 82      visitor.append(thisObject->m_prototypeChain);
 83  
 84      if (thisObject->cachedStructureID()) {
 85          VM& vm = visitor.vm();
 86          visitor.appendUnbarriered(vm.getStructure(thisObject->cachedStructureID()));
 87      }
 88  }
 89  
 90  // FIXME: Assert that properties returned by getOwnPropertyNames() are reported enumerable by getOwnPropertySlot().
 91  // https://bugs.webkit.org/show_bug.cgi?id=219926
 92  void getEnumerablePropertyNames(JSGlobalObject* globalObject, JSObject* base, PropertyNameArray& propertyNames, uint32_t& indexedLength, uint32_t& structurePropertyCount)
 93  {
 94      VM& vm = globalObject->vm();
 95      auto scope = DECLARE_THROW_SCOPE(vm);
 96  
 97      auto getOwnPropertyNames = [&](JSObject* object) {
 98          auto mode = DontEnumPropertiesMode::Exclude;
 99          if (object->type() == ProxyObjectType) {
100              // This ensures Proxy's [[GetOwnProperty]] trap is invoked only once per property, by OpHasEnumerableProperty.
101              // Although doing this for all objects is spec-conformant, collecting DontEnum properties isn't free.
102              mode = DontEnumPropertiesMode::Include;
103          }
104          object->methodTable(vm)->getOwnPropertyNames(object, globalObject, propertyNames, mode);
105      };
106  
107      Structure* structure = base->structure(vm);
108      if (structure->canAccessPropertiesQuicklyForEnumeration() && indexedLength == base->getArrayLength()) {
109          // Inlined JSObject::getOwnNonIndexPropertyNames()
110          base->methodTable(vm)->getOwnSpecialPropertyNames(base, globalObject, propertyNames, DontEnumPropertiesMode::Exclude);
111          RETURN_IF_EXCEPTION(scope, void());
112  
113          base->getNonReifiedStaticPropertyNames(vm, propertyNames, DontEnumPropertiesMode::Exclude);
114          unsigned nonStructurePropertyCount = propertyNames.size();
115          structure->getPropertyNamesFromStructure(vm, propertyNames, DontEnumPropertiesMode::Exclude);
116          scope.assertNoException();
117  
118          // |propertyNames| contains properties exclusively from the structure.
119          if (!nonStructurePropertyCount)
120              structurePropertyCount = propertyNames.size();
121      } else {
122          getOwnPropertyNames(base);
123          RETURN_IF_EXCEPTION(scope, void());
124          // |propertyNames| contains all indexed properties, so disable enumeration based on getEnumerableLength().
125          indexedLength = 0;
126      }
127  
128      JSObject* object = base;
129      unsigned prototypeCount = 0;
130  
131      while (true) {
132          JSValue prototype = object->getPrototype(vm, globalObject);
133          RETURN_IF_EXCEPTION(scope, void());
134          if (prototype.isNull())
135              break;
136  
137          if (UNLIKELY(++prototypeCount > JSObject::maximumPrototypeChainDepth)) {
138              throwStackOverflowError(globalObject, scope);
139              return;
140          }
141  
142          object = asObject(prototype);
143          getOwnPropertyNames(object);
144          RETURN_IF_EXCEPTION(scope, void());
145      }
146  }
147  
148  } // namespace JSC