Exemplo n.º 1
1
  /**
   * Converts the given value to the given NativeObject (optionally following the prototype chains).
   *
   * @param nativeObject target NativeObject
   * @param value Value to convert
   * @param prototype use the prototype chain?
   */
  public static Value toNativeObject(
      HostObject nativeObject,
      Value value,
      boolean prototype,
      Solver.SolverInterface solverInterface) {
    State state = solverInterface.getState();
    boolean bad = false;
    Set<ObjectLabel> matches = Collections.newSet();

    if (prototype) {
      // Make lookup using prototype chains
      Set<ObjectLabel> objectLabels = Collections.newSet(value.getObjectLabels());
      Set<ObjectLabel> visited = Collections.newSet();

      while (!objectLabels.isEmpty()) {
        Set<ObjectLabel> temp = Collections.newSet();
        for (ObjectLabel objectLabel : objectLabels) {
          if (!visited.contains(objectLabel)) {
            visited.add(objectLabel);
            Value prototypeValue =
                state.readInternalPrototype(java.util.Collections.singleton(objectLabel));
            prototypeValue = UnknownValueResolver.getRealValue(prototypeValue, state);

            // FIXME: Needs code review. Looks fishy to compare objects with toString().
            String nativeObjectPrototype = nativeObject.toString();
            String objectLabelPrototype = "";
            if (objectLabel.getHostObject() != null) {
              objectLabelPrototype = objectLabel.getHostObject().toString();
            }

            if (nativeObject == objectLabel.getHostObject()
                || nativeObjectPrototype.equals(objectLabelPrototype)) {
              matches.add(objectLabel);
            } else if (prototypeValue.getObjectLabels().isEmpty()) {
              bad = true;
            } else {
              temp.addAll(prototypeValue.getObjectLabels());
            }
          }
        }
        objectLabels = temp;
      }
    } else {
      // Make lookup ignoring prototype chains

      // TODO: Verify this
      for (ObjectLabel objectLabel : value.getObjectLabels()) {
        if (objectLabel.getHostObject() == nativeObject
            || (objectLabel.getHostObject() != null
                && objectLabel.getHostObject().toString().equals(nativeObject + ".prototype"))) {
          matches.add(objectLabel);
        } else {
          bad = true;
        }
      }
    }

    //        Message.Status status;
    //        if (good && bad) {
    //            status = Message.Status.MAYBE;
    //        } else if (!good && bad) {
    //            status = Message.Status.CERTAIN;
    //        } else if (good && !bad) {
    //            status = Message.Status.NONE;
    //        } else if (!good && !bad) { // equivalent to Value of Undef / a null argument
    //            // Considered a certain type error.
    //            status = Message.Status.CERTAIN;
    //        } else {
    //            throw new AnalysisException("toNativeObject: fell through cases - should not
    // happen.");
    //        }
    if (bad) {
      String message = "TypeError, argument is not of expected type: " + nativeObject;
      solverInterface
          .getMonitoring()
          .addMessage(solverInterface.getNode(), Message.Severity.HIGH, message);
    }

    return Value.makeObject(matches);
  }
Exemplo n.º 2
0
 /** 11.13 and 11.4 assignment with unary operator. */
 @Override
 public void visit(UnaryOperatorNode n, State state) {
   Value arg = state.readRegister(n.getArgRegister());
   arg = UnknownValueResolver.getRealValue(arg, state);
   Value v;
   switch (n.getOperator()) {
     case COMPLEMENT:
       v = Operators.complement(arg, n.getArgRegister(), c);
       break;
     case MINUS:
       v = Operators.uminus(arg, n.getArgRegister(), c);
       break;
     case NOT:
       v = Operators.not(arg, c);
       break;
     case PLUS:
       v = Operators.uplus(arg, n.getArgRegister(), c);
       break;
     default:
       throw new AnalysisException();
   }
   if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) {
     state.setToNone();
     return;
   }
   if (n.getResultRegister() != AbstractNode.NO_VALUE)
     state.writeRegister(n.getResultRegister(), v);
 }
Exemplo n.º 3
0
 /** 11.13 and 7.8 assignment with literal. */
 @Override
 public void visit(ConstantNode n, State state) {
   Value v;
   switch (n.getType()) {
     case NULL:
       v = Value.makeNull();
       break;
     case UNDEFINED:
       v = Value.makeUndef();
       break;
     case BOOLEAN:
       v = Value.makeBool(n.getBoolean());
       break;
     case NUMBER:
       v = Value.makeNum(n.getNumber());
       break;
     case STRING:
       v = Value.makeStr(n.getString());
       break;
     default:
       throw new AnalysisException();
   }
   if (n.getResultRegister() != AbstractNode.NO_VALUE)
     state.writeRegister(n.getResultRegister(), v);
 }
Exemplo n.º 4
0
 /** 12.14 'catch' block. */
 @Override
 public void visit(CatchNode n, State state) {
   Value v = state.readRegister(AbstractNode.EXCEPTION_REG);
   state.removeRegister(AbstractNode.EXCEPTION_REG);
   if (n.getValueRegister() != AbstractNode.NO_VALUE) {
     state.writeRegister(n.getValueRegister(), v.makeExtendedScope());
   } else {
     ObjectLabel objlabel = new ObjectLabel(n, Kind.OBJECT);
     state.newObject(objlabel);
     state.writeInternalPrototype(
         objlabel, Value.makeObject(InitialStateBuilder.OBJECT_PROTOTYPE));
     state.writePropertyWithAttributes(
         objlabel, n.getVariableName(), v.setAttributes(false, true, false));
     state.writeRegister(n.getScopeObjRegister(), Value.makeObject(objlabel));
     /* From ES5, Annex D:
     In Edition 3, an object is created, as if by new Object() to serve as the scope for resolving
     the name of the exception parameter passed to a catch clause of a try statement. If the actual
     exception object is a function and it is called from within the catch clause, the scope object
     will be passed as the this value of the call. The body of the function can then define new
     properties on its this value and those property names become visible identifiers bindings
     within the scope of the catch clause after the function returns. In Edition 5, when an
     exception parameter is called as a function, undefined is passed as the this value.
     */
     // TODO: use ES5 semantics of catch object?
   }
 }
Exemplo n.º 5
0
  /** Assumption. */
  @Override
  public void visit(AssumeNode n, State state) {
    if (Options.get().isControlSensitivityDisabled()) return;
    switch (n.getKind()) {
      case VARIABLE_NON_NULL_UNDEF:
        {
          Value v = state.readVariable(n.getVariableName(), null);
          v =
              UnknownValueResolver.getRealValue(
                  v, state); // TODO: limits use of polymorphic values?
          v = v.restrictToNotNullNotUndef().restrictToNotAbsent();
          if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) state.setToNone();
          else state.writeVariable(n.getVariableName(), v, false);
          break;
        }

      case PROPERTY_NON_NULL_UNDEF:
        {
          String propname;
          if (n.isPropertyFixed()) propname = n.getPropertyString();
          else {
            Value propval = state.readRegister(n.getPropertyRegister());
            propval =
                UnknownValueResolver.getRealValue(
                    propval, state); // TODO: limits use of polymorphic values?
            if (!propval.isMaybeSingleStr() || propval.isMaybeOtherThanStr())
              break; // safe to do nothing here if it gets complicated
            propname = propval.getStr();
          }
          Set<ObjectLabel> baseobjs =
              Conversion.toObjectLabels(
                  state,
                  n,
                  state.readRegister(n.getBaseRegister()),
                  null); // TODO: omitting side-effects here
          Value v = state.readPropertyWithAttributes(baseobjs, propname);
          if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) state.setToNone();
          else if (baseobjs.size() == 1 && baseobjs.iterator().next().isSingleton()) {
            v =
                UnknownValueResolver.getRealValue(
                    v, state); // TODO: limits use of polymorphic values?
            v = v.restrictToNotNullNotUndef().restrictToNotAbsent();
            state.writePropertyWithAttributes(baseobjs, propname, v, false);
          }
          break;
        }

      case UNREACHABLE:
        {
          if (Options.get().isIgnoreUnreachableEnabled()) {
            state.setToNone();
          }
          break;
        }

      default:
        throw new AnalysisException("Unhandled AssumeNode kind: " + n.getKind());
    }
  }
Exemplo n.º 6
0
 /** 11.1.5 object initializer. */
 @Override
 public void visit(NewObjectNode n, State state) {
   HeapContext heapContext =
       c.getAnalysis().getContextSensitivityStrategy().makeObjectLiteralHeapContext(n, state);
   ObjectLabel objlabel = new ObjectLabel(n, Kind.OBJECT, heapContext);
   state.newObject(objlabel);
   state.writeInternalPrototype(objlabel, Value.makeObject(InitialStateBuilder.OBJECT_PROTOTYPE));
   if (n.getResultRegister() != AbstractNode.NO_VALUE)
     state.writeRegister(n.getResultRegister(), Value.makeObject(objlabel));
 }
Exemplo n.º 7
0
 /** 11.2.1 assignment with left-hand-side property accessor. */
 @Override
 public void visit(WritePropertyNode n, State state) {
   // get the base value, coerce with ToObject
   Value baseval = state.readRegister(n.getBaseRegister());
   baseval = UnknownValueResolver.getRealValue(baseval, state);
   m.visitPropertyAccess(n, baseval);
   Set<ObjectLabel> objlabels = Conversion.toObjectLabels(state, n, baseval, c);
   if (objlabels.isEmpty() && !Options.get().isPropagateDeadFlow()) {
     state.setToNone();
     return;
   }
   state.writeRegister(
       n.getBaseRegister(),
       Value.makeObject(objlabels)); // if null/undefined, an exception would have been thrown via
   // toObjectLabels
   // get the property name value, separate the undefined/null/NaN components, coerce with ToString
   Value propertyval;
   int propertyreg;
   if (n.isPropertyFixed()) {
     propertyreg = AbstractNode.NO_VALUE;
     propertyval = Value.makeStr(n.getPropertyString());
   } else {
     propertyreg = n.getPropertyRegister();
     propertyval = state.readRegister(propertyreg);
     propertyval = UnknownValueResolver.getRealValue(propertyval, state);
   }
   boolean maybe_undef = propertyval.isMaybeUndef();
   boolean maybe_null = propertyval.isMaybeNull();
   boolean maybe_nan = propertyval.isMaybeNaN();
   propertyval = propertyval.restrictToNotNullNotUndef().restrictToNotNaN();
   Str propertystr = Conversion.toString(propertyval, propertyreg, c);
   // get the value to be written
   Value v = state.readRegister(n.getValueRegister());
   NativeFunctions.updateArrayLength(n, state, objlabels, propertystr, v, n.getValueRegister(), c);
   // write the object property value, as fixed property name or unknown property name, and
   // separately for "undefined"/"null"/"NaN"
   state.writeProperty(objlabels, propertystr, v, true, maybe_undef || maybe_null || maybe_nan);
   if (maybe_undef && !propertystr.isMaybeStr("undefined"))
     state.writeProperty(
         objlabels, Value.makeTemporaryStr("undefined"), v, true, !propertystr.isNotStr());
   if (maybe_null && !propertystr.isMaybeStr("null"))
     state.writeProperty(
         objlabels, Value.makeTemporaryStr("null"), v, true, !propertystr.isNotStr());
   if (maybe_nan && !propertystr.isMaybeStr("NaN"))
     state.writeProperty(
         objlabels, Value.makeTemporaryStr("NaN"), v, true, !propertystr.isNotStr());
   m.visitPropertyWrite(n, objlabels, propertystr); // TODO: more monitoring around here?
   if (Options.get().isEvalStatistics()
       && propertystr.getStr() != null
       && propertystr.getStr().equals("innerHTML")) {
     m.visitInnerHTMLWrite(n, v);
   }
   m.visitVariableOrProperty(
       n.getPropertyString(), n.getSourceLocation(), v, state.getContext(), state);
 }
Exemplo n.º 8
0
 /** 12.6.4 get next property of 'for-in' statement. */
 @Override
 public void visit(NextPropertyNode n, State state) {
   Value property_name =
       state
           .readRegister(n.getPropertyListRegister())
           .restrictToStr(); // restrictToStr to remove Null (the end-of-list marker)
   if (property_name.isNone()) { // possible if branch pruning in EdgeTransfer is disabled
     state.setToNone();
     return;
   }
   state.writeRegister(n.getPropertyRegister(), property_name);
 }
Exemplo n.º 9
0
 public static Value evaluate(
     DOMObjects nativeObject, FunctionCalls.CallInfo call, State s, Solver.SolverInterface c) {
   switch (nativeObject) {
     case MOUSE_EVENT_INIT_MOUSE_EVENT:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 15, 15);
         /* Value typeArg =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         /* Value canBubbleArg =*/ Conversion.toBoolean(NativeFunctions.readParameter(call, s, 1));
         /* Value cancelableArg =*/ Conversion.toBoolean(
             NativeFunctions.readParameter(call, s, 2));
         // View arg not checked
         /* Value detailArg =*/ Conversion.toNumber(NativeFunctions.readParameter(call, s, 4), c);
         /* Value screenXArg =*/ Conversion.toNumber(NativeFunctions.readParameter(call, s, 5), c);
         /* Value screenYArg =*/ Conversion.toNumber(NativeFunctions.readParameter(call, s, 6), c);
         /* Value clientXArg =*/ Conversion.toNumber(NativeFunctions.readParameter(call, s, 7), c);
         /* Value clientYArg =*/ Conversion.toNumber(NativeFunctions.readParameter(call, s, 8), c);
         /* Value ctrlKeyArg =*/ Conversion.toBoolean(NativeFunctions.readParameter(call, s, 9));
         /* Value altKeyArg =*/ Conversion.toBoolean(NativeFunctions.readParameter(call, s, 10));
         /* Value shiftKeyArg =*/ Conversion.toBoolean(NativeFunctions.readParameter(call, s, 11));
         /* Value metaKeyArg =*/ Conversion.toBoolean(NativeFunctions.readParameter(call, s, 12));
         /* Value buttonArg =*/ Conversion.toNumber(NativeFunctions.readParameter(call, s, 13), c);
         /* Value relatedTargetArg =*/ DOMConversion.toEventTarget(
             NativeFunctions.readParameter(call, s, 14), c);
         return Value.makeUndef();
       }
     default:
       throw new UnsupportedOperationException("Unsupported Native Object: " + nativeObject);
   }
 }
Exemplo n.º 10
0
 /** 11.1.2 assignment with right-hand-side identifier reference. */
 @Override
 public void visit(ReadVariableNode n, State state) {
   String varname = n.getVariableName();
   Value v;
   if (varname.equals("this")) {
     // 11.1.1 read 'this' from the execution context
     v = state.readThis();
     m.visitReadThis(n, v, state, InitialStateBuilder.GLOBAL);
   } else { // ordinary variable
     int result_base_reg = n.getResultBaseRegister();
     Set<ObjectLabel> base_objs = null;
     if (c.isScanning() || result_base_reg != AbstractNode.NO_VALUE) base_objs = newSet();
     v = state.readVariable(varname, base_objs);
     m.visitPropertyRead(n, base_objs, Value.makeTemporaryStr(varname), state, true);
     m.visitVariableAsRead(n, v, state);
     m.visitVariableOrProperty(varname, n.getSourceLocation(), v, state.getContext(), state);
     m.visitReadNonThisVariable(n, v);
     if (v.isMaybeAbsent()) Exceptions.throwReferenceError(state, c);
     if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) {
       state.setToNone();
       return;
     }
     if (result_base_reg != AbstractNode.NO_VALUE)
       state.writeRegister(result_base_reg, Value.makeObject(base_objs)); // see 10.1.4
     m.visitRead(n, v, state);
     m.visitReadVariable(n, v, state); // TODO: combine some of these m.visitXYZ methods?
   }
   if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) {
     state.setToNone();
     return;
   }
   if (n.getResultRegister() != AbstractNode.NO_VALUE)
     state.writeRegister(n.getResultRegister(), v.restrictToNotAbsent());
 }
Exemplo n.º 11
0
  public static void build(State s) {
    DOMNodeList.build(s);
    DOMNode.build(s);
    DOMAttr.build(s);
    DOMNamedNodeMap.build(s);
    DOMDocumentType.build(s);
    DOMException.build(s);
    DOMElement.build(s);
    DOMCharacterData.build(s);
    DOMText.build(s);
    DOMConfiguration.build(s);
    DOMNotation.build(s);
    DOMCDataSection.build(s);
    DOMComment.build(s);
    DOMEntity.build(s);
    DOMEntityReference.build(s);
    DOMProcessingInstruction.build(s);
    DOMStringList.build(s);
    DOMDocumentFragment.build(s);

    // Document
    DOMDocument.build(s);
    DOMImplementation.build(s);

    // Set the remaining properties on DOMNode, due to circularity, and
    // summarize.
    createDOMProperty(
        s,
        DOMNode.PROTOTYPE,
        "attributes",
        Value.makeObject(
            DOMNamedNodeMap.INSTANCES, new Dependency(), new DependencyGraphReference()),
        DOMSpec.LEVEL_1);
    createDOMProperty(
        s,
        DOMNode.PROTOTYPE,
        "ownerDocument",
        Value.makeObject(DOMDocument.INSTANCES, new Dependency(), new DependencyGraphReference()),
        DOMSpec.LEVEL_1);
    s.multiplyObject(DOMNode.INSTANCES);
    DOMNode.INSTANCES = DOMNode.INSTANCES.makeSingleton().makeSummary();
  }
Exemplo n.º 12
0
  /** Beginning of loop. */
  @Override
  public void visit(BeginLoopNode n, State state) {
    // TODO: do nothing if loop unrolling is disabled or in scanning mode

    Value v = state.readRegister(n.getIfNode().getConditionRegister());
    v = Conversion.toBoolean(UnknownValueResolver.getRealValue(v, state));
    if (v.isMaybeTrueButNotFalse() || v.isMaybeFalseButNotTrue()) {
      // branch condition is determinate, switch context and propagate only to specialized successor
      Context specializedContext =
          c.getAnalysis()
              .getContextSensitivityStrategy()
              .makeNextLoopUnrollingContext(state.getContext(), n);
      BasicBlock successor = state.getBasicBlock().getSingleSuccessor();
      State specializedState = state.clone();
      specializedState.setContext(specializedContext);
      specializedState.setBasicBlock(successor);
      c.propagateToBasicBlock(specializedState, successor, specializedContext);
      state.setToNone();
    } // otherwise, just ordinary propagation like no-op
  }
Exemplo n.º 13
0
  public static void build(Solver.SolverInterface c) {
    State s = c.getState();
    PropVarOperations pv = c.getAnalysis().getPropVarOperations();
    CONSTRUCTOR = new ObjectLabel(DOMObjects.HTMLHRELEMENT_CONSTRUCTOR, ObjectLabel.Kind.FUNCTION);
    PROTOTYPE = new ObjectLabel(DOMObjects.HTMLHRELEMENT_PROTOTYPE, ObjectLabel.Kind.OBJECT);
    INSTANCES = new ObjectLabel(DOMObjects.HTMLHRELEMENT_INSTANCES, ObjectLabel.Kind.OBJECT);

    // Constructor Object
    s.newObject(CONSTRUCTOR);
    pv.writePropertyWithAttributes(
        CONSTRUCTOR, "length", Value.makeNum(0).setAttributes(true, true, true));
    pv.writePropertyWithAttributes(
        CONSTRUCTOR, "prototype", Value.makeObject(PROTOTYPE).setAttributes(true, true, true));
    s.writeInternalPrototype(CONSTRUCTOR, Value.makeObject(InitialStateBuilder.FUNCTION_PROTOTYPE));
    pv.writeProperty(DOMWindow.WINDOW, "HTMLHRElement", Value.makeObject(CONSTRUCTOR));

    // Prototype Object
    s.newObject(PROTOTYPE);
    s.writeInternalPrototype(PROTOTYPE, Value.makeObject(HTMLElement.ELEMENT_PROTOTYPE));

    // Multiplied Object
    s.newObject(INSTANCES);
    s.writeInternalPrototype(INSTANCES, Value.makeObject(PROTOTYPE));

    /*
     * Properties.
     */
    // DOM Level 1
    createDOMProperty(INSTANCES, "align", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "noShade", Value.makeAnyBool(), c);
    createDOMProperty(INSTANCES, "size", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "width", Value.makeAnyStr(), c);

    s.multiplyObject(INSTANCES);
    INSTANCES = INSTANCES.makeSingleton().makeSummary();

    /*
     * Functions.
     */
    // No functions.
  }
Exemplo n.º 14
0
  /*
   * Transfer functions
   */
  public static Value evaluate(
      DOMObjects nativeObject, FunctionCalls.CallInfo call, State s, Solver.SolverInterface c) {
    switch (nativeObject) {
      case ACTIVE_X_OBJECT_OPEN:
        {
          NativeFunctions.expectParameters(nativeObject, call, c, 2, 5);
          /* Value method =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
          /* Value url =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
          return Value.makeUndef();
        }

      case ACTIVE_X_OBJECT_SET_REQUEST_HEADER:
        {
          NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
          /* Value header =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
          /* Value value =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
          return Value.makeUndef();
        }

      case ACTIVE_X_OBJECT_SEND:
        {
          NativeFunctions.expectParameters(nativeObject, call, c, 0, 1);
          return Value.makeUndef();
        }

      case ACTIVE_X_OBJECT_ABORT:
        {
          NativeFunctions.expectParameters(nativeObject, call, c, 0, 0);
          return Value.makeUndef();
        }

      case ACTIVE_X_OBJECT_GET_RESPONSE_HEADER:
        {
          NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
          /* Value header =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
          return Value.makeAnyStr();
        }

      case ACTIVE_X_OBJECT_GET_ALL_RESPONSE_HEADERS:
        {
          NativeFunctions.expectParameters(nativeObject, call, c, 0, 0);
          return Value.makeAnyStr();
        }

      case ACTIVE_X_OBJECT_CONSTRUCTOR:
        {
          // TODO: Check if this is sound.
          return Value.makeObject(INSTANCES).joinUndef();
        }

      default:
        {
          throw new AnalysisException("Unknown Native Object: " + nativeObject);
        }
    }
  }
Exemplo n.º 15
0
 /**
  * Transfer for a return statement.
  *
  * @param caller if non-null, only consider this caller
  */
 public void transferReturn(
     int valueReg,
     BasicBlock block,
     State state,
     NodeAndContext<Context> caller,
     Context edge_context) {
   Value v;
   if (valueReg != AbstractNode.NO_VALUE) v = state.readRegister(valueReg);
   else v = Value.makeUndef();
   UserFunctionCalls.leaveUserFunction(
       v, false, block.getFunction(), state, c, caller, edge_context);
 }
Exemplo n.º 16
0
 /** 12.6.4 check for more properties of 'for-in' statement. */
 @Override
 public void visit(HasNextPropertyNode n, State state) {
   Value v =
       UnknownValueResolver.getRealValue(state.readRegister(n.getPropertyListRegister()), state);
   Value res =
       !v.isNotStr()
           ? Value.makeBool(true)
           : Value.makeNone(); // string values represent property names
   if (v.isMaybeNull()) // null marks end-of-list
   res = res.joinBool(false);
   state.writeRegister(n.getResultRegister(), res);
 }
Exemplo n.º 17
0
 /** 11.13 and 11.1.2 assignment with left-hand-side identifier reference. */
 @Override
 public void visit(WriteVariableNode n, State state) {
   Value v = state.readRegister(n.getValueRegister());
   m.visitWriteVariable(n, v, state);
   Set<ObjectLabel> objs = state.writeVariable(n.getVariableName(), v, true);
   Function f = n.getBlock().getFunction();
   if (f.getParameterNames().contains(n.getVariableName())) { // TODO: review
     ObjectLabel arguments_obj = new ObjectLabel(f.getEntry().getFirstNode(), Kind.ARGUMENTS);
     state.writeProperty(
         arguments_obj, Integer.toString(f.getParameterNames().indexOf(n.getVariableName())), v);
   }
   m.visitPropertyWrite(n, objs, Value.makeTemporaryStr(n.getVariableName()));
   m.visitVariableOrProperty(
       n.getVariableName(), n.getSourceLocation(), v, state.getContext(), state);
 }
Exemplo n.º 18
0
 /** 11.13 and 11.4.3 assignment with 'typeof' operator. */
 @Override
 public void visit(TypeofNode n, State state) {
   Value v;
   if (n.isVariable()) {
     Value val =
         state.readVariable(
             n.getVariableName(),
             null); // TODO: should also count as a variable read in Monitoring?
     val = UnknownValueResolver.getRealValue(val, state);
     v = Operators.typeof(val, val.isMaybeAbsent());
     m.visitVariableOrProperty(
         n.getVariableName(), n.getOperandSourceLocation(), val, state.getContext(), state);
   } else {
     Value val = state.readRegister(n.getArgRegister());
     val = UnknownValueResolver.getRealValue(val, state);
     v = Operators.typeof(val, false);
   }
   if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) {
     state.setToNone();
     return;
   }
   if (n.getResultRegister() != AbstractNode.NO_VALUE)
     state.writeRegister(n.getResultRegister(), v);
 }
Exemplo n.º 19
0
 /** 11.13 and 11.4.1 assignment with 'delete' operator. */
 @Override
 public void visit(DeletePropertyNode n, State state) {
   Value v;
   if (n.isVariable()) {
     v = state.deleteVariable(n.getVariableName());
     m.visitVariableOrProperty(
         n.getVariableName(), n.getSourceLocation(), v, state.getContext(), state);
   } else {
     Value baseval = state.readRegister(n.getBaseRegister());
     baseval = UnknownValueResolver.getRealValue(baseval, state);
     m.visitPropertyAccess(n, baseval);
     if (baseval.isMaybeNull() || baseval.isMaybeUndef()) {
       Exceptions.throwTypeError(state, c);
       if (baseval.isNullOrUndef() && !Options.get().isPropagateDeadFlow()) {
         state.setToNone();
         return;
       }
     }
     baseval = baseval.restrictToNotNullNotUndef();
     state.writeRegister(n.getBaseRegister(), baseval);
     Set<ObjectLabel> objlabels = Conversion.toObjectLabels(state, n, baseval, c);
     if (objlabels.isEmpty() && !Options.get().isPropagateDeadFlow()) {
       state.setToNone();
       return;
     }
     Str propertystr;
     if (n.isPropertyFixed()) {
       propertystr = Value.makeStr(n.getPropertyString());
     } else {
       Value propertyval = state.readRegister(n.getPropertyRegister());
       propertystr = Conversion.toString(propertyval, n.getPropertyRegister(), c);
     }
     v = state.deleteProperty(objlabels, propertystr, false);
   }
   if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) {
     state.setToNone();
     return;
   }
   if (n.getResultRegister() != AbstractNode.NO_VALUE)
     state.writeRegister(n.getResultRegister(), v);
 }
Exemplo n.º 20
0
  public static void build(State s) {
    CONSTRUCTOR =
        new ObjectLabel(DOMObjects.HTMLBASEELEMENT_CONSTRUCTOR, ObjectLabel.Kind.FUNCTION);
    PROTOTYPE = new ObjectLabel(DOMObjects.HTMLBASEELEMENT_PROTOTYPE, ObjectLabel.Kind.OBJECT);
    INSTANCES = new ObjectLabel(DOMObjects.HTMLBASEELEMENT_INSTANCES, ObjectLabel.Kind.OBJECT);

    // Constructor Object
    s.newObject(CONSTRUCTOR);
    s.writePropertyWithAttributes(
        CONSTRUCTOR, "length", Value.makeNum(0).setAttributes(true, true, true));
    s.writePropertyWithAttributes(
        CONSTRUCTOR, "prototype", Value.makeObject(PROTOTYPE).setAttributes(true, true, true));
    s.writeInternalPrototype(CONSTRUCTOR, Value.makeObject(InitialStateBuilder.OBJECT_PROTOTYPE));
    s.writeProperty(DOMWindow.WINDOW, "HTMLBaseElement", Value.makeObject(CONSTRUCTOR));

    // Prototype Object
    s.newObject(PROTOTYPE);
    s.writeInternalPrototype(PROTOTYPE, Value.makeObject(HTMLElement.ELEMENT_PROTOTYPE));

    // Multiplied Object
    s.newObject(INSTANCES);
    s.writeInternalPrototype(INSTANCES, Value.makeObject(PROTOTYPE));

    /*
     * Properties.
     */
    // DOM LEVEL 1
    createDOMProperty(s, INSTANCES, "href", Value.makeAnyStr());
    createDOMProperty(s, INSTANCES, "target", Value.makeAnyStr());

    s.multiplyObject(INSTANCES);
    INSTANCES = INSTANCES.makeSingleton().makeSummary();

    /*
     * Functions.
     */
    // No functions.
  }
Exemplo n.º 21
0
  public static void build(Solver.SolverInterface c) {
    State s = c.getState();
    PropVarOperations pv = c.getAnalysis().getPropVarOperations();
    CONSTRUCTOR = new ObjectLabel(DOMObjects.COMMENT_CONSTRUCTOR, ObjectLabel.Kind.FUNCTION);
    PROTOTYPE = new ObjectLabel(DOMObjects.COMMENT_PROTOTYPE, ObjectLabel.Kind.OBJECT);
    INSTANCES = new ObjectLabel(DOMObjects.COMMENT_INSTANCES, ObjectLabel.Kind.OBJECT);

    // Constructor Object
    s.newObject(CONSTRUCTOR);
    pv.writePropertyWithAttributes(
        CONSTRUCTOR, "length", Value.makeNum(0).setAttributes(true, true, true));
    pv.writePropertyWithAttributes(
        CONSTRUCTOR, "prototype", Value.makeObject(PROTOTYPE).setAttributes(true, true, true));
    s.writeInternalPrototype(CONSTRUCTOR, Value.makeObject(InitialStateBuilder.OBJECT_PROTOTYPE));
    pv.writeProperty(DOMWindow.WINDOW, "Comment", Value.makeObject(CONSTRUCTOR));

    // Prototype object.
    s.newObject(PROTOTYPE);
    s.writeInternalPrototype(PROTOTYPE, Value.makeObject(DOMCharacterData.PROTOTYPE));

    // Multiplied object.
    s.newObject(INSTANCES);
    s.writeInternalPrototype(INSTANCES, Value.makeObject(PROTOTYPE));
    s.multiplyObject(INSTANCES);
    INSTANCES = INSTANCES.makeSingleton().makeSummary();

    /*
     * Properties.
     */
    // No properties.

    /*
     * Functions.
     */
    // No functions.
  }
Exemplo n.º 22
0
  public static void build(Solver.SolverInterface c) {
    State s = c.getState();
    PropVarOperations pv = c.getAnalysis().getPropVarOperations();
    CONSTRUCTOR =
        new ObjectLabel(DOMObjects.HTMLOBJECTELEMENT_CONSTRUCTOR, ObjectLabel.Kind.FUNCTION);
    PROTOTYPE = new ObjectLabel(DOMObjects.HTMLOBJECTELEMENT_PROTOTYPE, ObjectLabel.Kind.OBJECT);
    INSTANCES = new ObjectLabel(DOMObjects.HTMLOBJECTELEMENT_INSTANCES, ObjectLabel.Kind.OBJECT);

    // Constructor Object
    s.newObject(CONSTRUCTOR);
    pv.writePropertyWithAttributes(
        CONSTRUCTOR, "length", Value.makeNum(0).setAttributes(true, true, true));
    pv.writePropertyWithAttributes(
        CONSTRUCTOR, "prototype", Value.makeObject(PROTOTYPE).setAttributes(true, true, true));
    s.writeInternalPrototype(CONSTRUCTOR, Value.makeObject(InitialStateBuilder.FUNCTION_PROTOTYPE));
    pv.writeProperty(DOMWindow.WINDOW, "HTMLObjectElement", Value.makeObject(CONSTRUCTOR));

    // Prototype Object
    s.newObject(PROTOTYPE);
    s.writeInternalPrototype(PROTOTYPE, Value.makeObject(HTMLElement.ELEMENT_PROTOTYPE));

    // Multiplied Object
    s.newObject(INSTANCES);
    s.writeInternalPrototype(INSTANCES, Value.makeObject(PROTOTYPE));

    /*
     * Properties.
     */
    // DOM Level 1
    createDOMProperty(
        INSTANCES, "form", Value.makeObject(HTMLFormElement.INSTANCES).setReadOnly(), c);
    createDOMProperty(INSTANCES, "code", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "align", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "archive", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "border", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "codeBase", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "codeType", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "data", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "declare", Value.makeAnyBool(), c);
    createDOMProperty(INSTANCES, "height", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "hspace", Value.makeAnyNum(), c);
    createDOMProperty(INSTANCES, "name", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "standby", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "tabIndex", Value.makeAnyNum(), c);
    createDOMProperty(
        INSTANCES, "type", Value.makeAnyStr().restrictToNotStrIdentifierParts() /* mime-type */, c);
    createDOMProperty(INSTANCES, "useMap", Value.makeAnyStr(), c);
    createDOMProperty(INSTANCES, "vspace", Value.makeAnyNum(), c);
    createDOMProperty(INSTANCES, "width", Value.makeAnyStr(), c);

    // DOM Level 2
    createDOMProperty(
        INSTANCES, "contentDocument", Value.makeObject(DOMDocument.INSTANCES).setReadOnly(), c);

    s.multiplyObject(INSTANCES);
    INSTANCES = INSTANCES.makeSingleton().makeSummary();

    /*
     * Functions.
     */
    // No functions.
  }
Exemplo n.º 23
0
  /** Evaluates the given native function. */
  public static Value evaluate(
      ECMAScriptObjects nativeobject,
      CallInfo<? extends Node> call,
      State state,
      Solver.SolverInterface c) {
    if (NativeFunctions.throwTypeErrorIfConstructor(call, state, c))
      return Value.makeBottom(new Dependency(), new DependencyGraphReference());

    switch (nativeobject) {
      case MATH_ABS: // 15.8.2.1
      case MATH_ASIN: // 15.8.2.3
      case MATH_ACOS: // 15.8.2.2
      case MATH_ATAN: // 15.8.2.4
      case MATH_CEIL: // 15.8.2.6
      case MATH_COS: // 15.8.2.7
      case MATH_EXP: // 15.8.2.8
      case MATH_FLOOR: // 15.8.2.9
      case MATH_LOG: // 15.8.2.10
      case MATH_ROUND: // 15.8.2.15
      case MATH_SIN: // 15.8.2.16
      case MATH_SQRT: // 15.8.2.17
      case MATH_TAN:
        { // 15.8.2.18
          // ##################################################
          Dependency dependency = new Dependency();
          // ##################################################

          NativeFunctions.expectParameters(nativeobject, call, c, 1, 1);
          Value num = Conversion.toNumber(NativeFunctions.readParameter(call, 0), c);

          // ##################################################
          dependency.join(num.getDependency());
          // ##################################################

          // ==================================================
          DependencyExpressionNode node =
              DependencyNode.link(Label.CALL, call.getSourceNode(), num, state);
          // ==================================================

          if (num.isMaybeSingleNum()) {
            double d = num.getNum();
            double res;
            switch (nativeobject) {
              case MATH_ABS:
                res = Math.abs(d);
                break;
              case MATH_ASIN:
                res = Math.asin(d);
                break;
              case MATH_ACOS:
                res = Math.acos(d);
                break;
              case MATH_ATAN:
                res = Math.atan(d);
                break;
              case MATH_CEIL:
                res = Math.ceil(d);
                break;
              case MATH_COS:
                res = Math.cos(d);
                break;
              case MATH_EXP:
                res = Math.exp(d);
                break;
              case MATH_FLOOR:
                res = Math.floor(d);
                break;
              case MATH_LOG:
                res = Math.log(d);
                break;
              case MATH_ROUND:
                res = Math.round(d);
                break;
              case MATH_SIN:
                res = Math.sin(d);
                break;
              case MATH_SQRT:
                res = Math.sqrt(d);
                break;
              case MATH_TAN:
                res = Math.tan(d);
                break;
              default:
                throw new RuntimeException();
            }
            return Value.makeNum(res, dependency, node.getReference());
          } else if (!num.isNotNum()) return Value.makeAnyNum(dependency, node.getReference());
          else return Value.makeBottom(dependency, node.getReference());
        }

      case MATH_ATAN2: // 15.8.2.5
      case MATH_POW:
        { // 15.8.2.13
          // ##################################################
          Dependency dependency = new Dependency();
          // ##################################################

          NativeFunctions.expectParameters(nativeobject, call, c, 2, 2);
          Value num1 = Conversion.toNumber(NativeFunctions.readParameter(call, 0), c);
          Value num2 = Conversion.toNumber(NativeFunctions.readParameter(call, 1), c);

          // ##################################################
          dependency.join(num1.getDependency());
          dependency.join(num2.getDependency());
          // ##################################################

          // ==================================================
          DependencyExpressionNode node =
              DependencyNode.link(Label.CALL, call.getSourceNode(), num1, num2, state);
          // ==================================================

          if (num1.isMaybeSingleNum() && num2.isMaybeSingleNum()) {
            double d1 = num1.getNum();
            double d2 = num2.getNum();
            double res;
            switch (nativeobject) {
              case MATH_ATAN2:
                res = Math.atan2(d1, d2);
                break;
              case MATH_POW:
                res = Math.pow(d1, d2);
                break;
              default:
                throw new RuntimeException();
            }
            return Value.makeNum(res, dependency, node.getReference());
          } else if (!num1.isNotNum() && !num2.isNotNum())
            return Value.makeAnyNum(dependency, node.getReference());
          else return Value.makeBottom(dependency, node.getReference());
        }

      case MATH_MAX:
        { // 15.8.2.11
          // ##################################################
          Dependency dependency = new Dependency();
          // ##################################################

          // ==================================================
          DependencyExpressionNode node =
              DependencyNode.link(Label.CALL, call.getSourceNode(), state);
          // ==================================================

          double res = Double.NEGATIVE_INFINITY;

          if (call.isUnknownNumberOfArgs()) {
            Value num = Conversion.toNumber(NativeFunctions.readUnknownParameter(call), c);

            // ##################################################
            dependency.join(num.getDependency());
            // ##################################################

            // ==================================================
            node.addParent(num.getDependencyGraphReference());
            // ==================================================

            if (num.isMaybeSingleNum()) res = num.getNum();
            else if (!num.isNotNum()) return Value.makeAnyNum(dependency, node.getReference());
            else return Value.makeBottom(dependency, node.getReference());
          } else
            for (int i = 0; i < call.getNumberOfArgs(); i++) {
              Value num = Conversion.toNumber(NativeFunctions.readParameter(call, i), c);

              // ##################################################
              dependency.join(num.getDependency());
              // ##################################################

              // ==================================================
              node.addParent(num.getDependencyGraphReference());
              // ==================================================

              if (num.isMaybeSingleNum()) res = Math.max(res, num.getNum());
              else if (!num.isNotNum()) return Value.makeAnyNum(dependency, node.getReference());
              else return Value.makeBottom(dependency, node.getReference());
            }
          return Value.makeNum(res, dependency, node.getReference());
        }

      case MATH_MIN:
        { // 15.8.2.12
          // ##################################################
          Dependency dependency = new Dependency();
          // ##################################################

          // ==================================================
          DependencyExpressionNode node =
              DependencyNode.link(Label.CALL, call.getSourceNode(), state);
          // ==================================================

          double res = Double.POSITIVE_INFINITY;

          if (call.isUnknownNumberOfArgs()) {
            Value num = Conversion.toNumber(NativeFunctions.readUnknownParameter(call), c);

            // ##################################################
            dependency.join(num.getDependency());
            // ##################################################

            // ==================================================
            node.addParent(num.getDependencyGraphReference());
            // ==================================================

            if (num.isMaybeSingleNum()) res = num.getNum();
            else if (!num.isNotNum()) return Value.makeAnyNum(dependency, node.getReference());
            else return Value.makeBottom(dependency, node.getReference());
          } else
            for (int i = 0; i < call.getNumberOfArgs(); i++) {
              Value num = Conversion.toNumber(NativeFunctions.readParameter(call, i), c);

              // ##################################################
              dependency.join(num.getDependency());
              // ##################################################

              // ==================================================
              node.addParent(num.getDependencyGraphReference());
              // ==================================================

              if (num.isMaybeSingleNum()) res = Math.min(res, num.getNum());
              else if (!num.isNotNum()) return Value.makeAnyNum(dependency, node.getReference());
              else return Value.makeBottom(dependency, node.getReference());
            }
          return Value.makeNum(res, dependency, node.getReference());
        }

      case MATH_RANDOM:
        { // 15.8.2.14
          // ##################################################
          Dependency dependency = new Dependency();
          // ##################################################

          // ==================================================
          DependencyExpressionNode node =
              DependencyNode.link(Label.CALL, call.getSourceNode(), state);
          // ==================================================

          NativeFunctions.expectParameters(nativeobject, call, c, 0, 0);
          return Value.makeAnyNumNotNaNInf(dependency, node.getReference());
        }

      default:
        return null;
    }
  }
Exemplo n.º 24
0
 /** Transfer Functions. */
 public static Value evaluate(DOMObjects nativeObject, CallInfo call, Solver.SolverInterface c) {
   State s = c.getState();
   switch (nativeObject) {
     case ELEMENT_GET_ATTRIBUTE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         return Value.makeAnyStr();
       }
     case ELEMENT_SET_ATTRIBUTE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         /* Value value =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
         return Value.makeUndef();
       }
     case ELEMENT_REMOVE_ATTRIBUTE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         return Value.makeUndef();
       }
     case ELEMENT_GET_ATTRIBUTE_NS:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
         /* Value namespace =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
         return Value.makeAnyStr();
       }
     case ELEMENT_GET_ATTRIBUTE_NODE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         return Value.makeObject(DOMAttr.INSTANCES);
       }
     case ELEMENT_GET_ATTRIBUTE_NODE_NS:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
         /* Value namespace =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
         return Value.makeObject(DOMAttr.INSTANCES);
       }
     case ELEMENT_GET_BOUNDING_CLIENT_RECT:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 0, 0);
         return Value.makeObject(ClientBoundingRect.INSTANCES);
       }
     case ELEMENT_GET_ELEMENTS_BY_TAGNAME:
       {
         // TODO: needs precision, but cannot do like document.getElementsByTagName() bc. State is
         // for everything
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         return Value.makeObject(DOMNodeList.INSTANCES);
       }
     case ELEMENT_GET_ELEMENTS_BY_TAGNAME_NS:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
         /* Value namespace =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
         return Value.makeObject(DOMNodeList.INSTANCES);
       }
     case ELEMENT_HAS_ATTRIBUTE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         return Value.makeAnyBool();
       }
     case ELEMENT_HAS_ATTRIBUTE_NS:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
         /* Value namespace =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
         return Value.makeAnyBool();
       }
     case ELEMENT_REMOVE_ATTRIBUTE_NS:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
         /* Value namespaceURI =*/ Conversion.toString(
             NativeFunctions.readParameter(call, s, 0), c);
         /* Value localName =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
         return Value.makeUndef();
       }
     case ELEMENT_REMOVE_ATTRIBUTE_NODE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         return DOMConversion.toAttr(NativeFunctions.readParameter(call, s, 0), c);
       }
     case ELEMENT_SET_ATTRIBUTE_NS:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 3, 3);
         /* Value namespace =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c)
             .joinNull();
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
         /* Value value =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 2), c);
         return Value.makeUndef();
       }
     case ELEMENT_SET_ATTRIBUTE_NODE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         /* Value newAttr =*/ DOMConversion.toAttr(NativeFunctions.readParameter(call, s, 0), c);
         return Value.makeObject(DOMAttr.INSTANCES).joinNull();
       }
     case ELEMENT_SET_ATTRIBUTE_NODE_NS:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         /* Value newAttr =*/ DOMConversion.toAttr(NativeFunctions.readParameter(call, s, 0), c);
         return Value.makeObject(DOMAttr.INSTANCES).joinNull();
       }
     case ELEMENT_SET_ID_ATTRIBUTE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
         /* Value name =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 0), c);
         /* Value isId =*/ Conversion.toBoolean(NativeFunctions.readParameter(call, s, 1));
         return Value.makeUndef();
       }
     case ELEMENT_SET_ID_ATTRIBUTE_NS:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 3, 3);
         /* Value namespaceURI =*/ Conversion.toString(
             NativeFunctions.readParameter(call, s, 0), c);
         /* Value localName =*/ Conversion.toString(NativeFunctions.readParameter(call, s, 1), c);
         /* Value isId =*/ Conversion.toBoolean(NativeFunctions.readParameter(call, s, 2));
         return Value.makeUndef();
       }
     case ELEMENT_SET_ID_ATTRIBUTE_NODE:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 2, 2);
         /* Value idAttr =*/ DOMConversion.toAttr(NativeFunctions.readParameter(call, s, 0), c);
         /* Value isId =*/ Conversion.toBoolean(NativeFunctions.readParameter(call, s, 1));
         return Value.makeUndef();
       }
     case ELEMENT_QUERY_SELECTOR_ALL:
       {
         NativeFunctions.expectParameters(nativeObject, call, c, 1, 1);
         return Value.makeObject(DOMNodeList.INSTANCES);
       }
     default:
       {
         throw new AnalysisException("Unknown Native Object: " + nativeObject);
       }
   }
 }
Exemplo n.º 25
0
  /** 12.6.4 begin 'for-in' statement. */
  @Override
  public void visit(BeginForInNode n, State state) {
    if (!Options.get().isForInSpecializationDisabled()) {
      // 1. Find properties to iterate through
      Value v1 = state.readRegister(n.getObjectRegister());
      state.writeRegister(
          n.getObjectRegister(), v1.makeExtendedScope()); // preserve the register value
      v1 = UnknownValueResolver.getRealValue(v1, state);
      Set<ObjectLabel> objs = Conversion.toObjectLabels(state, n, v1, c);
      State.Properties p = state.getEnumProperties(objs);
      Collection<Value> propertyNameValues = newList(p.toValues());

      // Add the no-iteration case
      propertyNameValues.add(Value.makeNull().makeExtendedScope());

      // 2. Make specialized context for each iteration
      int it = n.getPropertyListRegister();
      //            List<Context> specialized_contexts = newList();
      BasicBlock successor = n.getBlock().getSingleSuccessor();
      for (Value k : propertyNameValues) {
        m.visitPropertyRead(n, objs, k, state, true);
        if (!c.isScanning()) {
          // 2.1 Make specialized context
          State specialized_state = state.clone();
          specialized_state.writeRegister(it, k);
          Context specialized_context =
              c.getAnalysis()
                  .getContextSensitivityStrategy()
                  .makeForInEntryContext(state.getContext(), n, k);
          //                    specialized_contexts.add(specialized_context);
          specialized_state.setContext(specialized_context);
          specialized_state.setBasicBlock(successor);
          // 2.2  Propagate specialized context
          c.propagateToFunctionEntry(
              n, state.getContext(), specialized_state, specialized_context, successor);
        }
      }
      if (!c.isScanning()) {
        // TODO: could kill flow to specializations if covered by other context
        // List<Context> previousSpecializations = c.getAnalysis().getForInSpecializations(n,
        // s.getContext());
        // if (previousSpecializations != null && (p.isArray() || p.isNonArray())) {
        //    previousSpecializations.forEach(c -> {
        //        // covered.setToNone();
        //    });
        //  }

        // TODO: could kill null flow unless all iterations has reached at least one EndForInNode
      }
      state.setToNone();
    } else { // fall back to simple mode without context specialization
      Value v1 = state.readRegister(n.getObjectRegister());
      state.writeRegister(
          n.getObjectRegister(), v1.makeExtendedScope()); // preserve the register value
      v1 = UnknownValueResolver.getRealValue(v1, state);
      Set<ObjectLabel> objs = Conversion.toObjectLabels(state, n, v1, c);
      Properties p = state.getEnumProperties(objs);
      Value proplist = p.toValue().joinNull();
      m.visitPropertyRead(n, objs, proplist, state, true);
      state.writeRegister(n.getPropertyListRegister(), proplist);
    }
  }
Exemplo n.º 26
0
  public static void build(Solver.SolverInterface c) {
    State s = c.getState();
    PropVarOperations pv = c.getAnalysis().getPropVarOperations();
    CONSTRUCTOR = new ObjectLabel(DOMObjects.ELEMENT_CONSTRUCTOR, ObjectLabel.Kind.FUNCTION);
    PROTOTYPE = new ObjectLabel(DOMObjects.ELEMENT_PROTOTYPE, ObjectLabel.Kind.OBJECT);
    INSTANCES = new ObjectLabel(DOMObjects.ELEMENT_INSTANCES, ObjectLabel.Kind.OBJECT);

    // Constructor Object
    s.newObject(CONSTRUCTOR);
    pv.writePropertyWithAttributes(
        CONSTRUCTOR, "length", Value.makeNum(0).setAttributes(true, true, true));
    pv.writePropertyWithAttributes(
        CONSTRUCTOR, "prototype", Value.makeObject(PROTOTYPE).setAttributes(true, true, true));
    s.writeInternalPrototype(CONSTRUCTOR, Value.makeObject(InitialStateBuilder.OBJECT_PROTOTYPE));
    pv.writeProperty(DOMWindow.WINDOW, "Element", Value.makeObject(CONSTRUCTOR));

    // Prototype
    s.newObject(PROTOTYPE);
    s.writeInternalPrototype(PROTOTYPE, Value.makeObject(DOMNode.PROTOTYPE));

    // Multiplied object
    s.newObject(INSTANCES);
    s.writeInternalPrototype(INSTANCES, Value.makeObject(PROTOTYPE));

    /*
     * Properties.
     */
    // DOM Level 1
    createDOMProperty(INSTANCES, "tagName", Value.makeAnyStr(), c);

    s.multiplyObject(INSTANCES);
    INSTANCES = INSTANCES.makeSingleton().makeSummary();

    /*
     * Functions.
     */
    // Unknown
    createDOMFunction(
        PROTOTYPE, DOMObjects.ELEMENT_GET_BOUNDING_CLIENT_RECT, "getBoundingClientRect", 0, c);

    // DOM Level 1
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_GET_ATTRIBUTE, "getAttribute", 1, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_SET_ATTRIBUTE, "setAttribute", 2, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_REMOVE_ATTRIBUTE, "removeAttribute", 1, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_GET_ATTRIBUTE_NODE, "getAttributeNode", 1, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_SET_ATTRIBUTE_NODE, "setAttributeNode", 2, c);
    createDOMFunction(
        PROTOTYPE, DOMObjects.ELEMENT_REMOVE_ATTRIBUTE_NODE, "removeAttributeNode", 1, c);
    createDOMFunction(
        PROTOTYPE, DOMObjects.ELEMENT_GET_ELEMENTS_BY_TAGNAME, "getElementsByTagName", 1, c);

    // DOM Level 2
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_GET_ATTRIBUTE_NS, "getAttributeNS", 2, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_SET_ATTRIBUTE_NS, "setAttributeNS", 3, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_REMOVE_ATTRIBUTE_NS, "removeAttributeNS", 2, c);
    createDOMFunction(
        PROTOTYPE, DOMObjects.ELEMENT_GET_ATTRIBUTE_NODE_NS, "getAttributeNodeNS", 2, c);
    createDOMFunction(
        PROTOTYPE, DOMObjects.ELEMENT_SET_ATTRIBUTE_NODE_NS, "setAttributeNodeNS", 3, c);
    createDOMFunction(
        PROTOTYPE, DOMObjects.ELEMENT_GET_ELEMENTS_BY_TAGNAME_NS, "getElementsByTagNameNS", 2, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_HAS_ATTRIBUTE, "hasAttribute", 1, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_HAS_ATTRIBUTE_NS, "hasAttributeNS", 2, c);

    // DOM Level 3
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_SET_ID_ATTRIBUTE, "setIdAttribute", 2, c);
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_SET_ID_ATTRIBUTE_NS, "setIdAttributeNS", 3, c);
    createDOMFunction(
        PROTOTYPE, DOMObjects.ELEMENT_SET_ID_ATTRIBUTE_NODE, "setIdAttributeNode", 2, c);

    // DOM Level 2
    createDOMProperty(
        DOMAttr.INSTANCES, "ownerElement", Value.makeObject(INSTANCES).setReadOnly(), c);

    // semistandard
    createDOMFunction(PROTOTYPE, DOMObjects.ELEMENT_QUERY_SELECTOR_ALL, "querySelectorAll", 1, c);
  }
Exemplo n.º 27
0
  /** 11.2.2, 11.2.3, 13.2.1, and 13.2.2 'new' / function call. */
  @Override
  public void visit(CallNode n, State state) {
    if (n.getFunctionRegister()
        != AbstractNode.NO_VALUE) // old style call (where the function is given as a variable read)
    FunctionCalls.callFunction(
          new OrdinaryCallInfo(n, state) {

            @Override
            public Value getFunctionValue() {
              Value functionValue = state.readRegister(n.getFunctionRegister());
              if (n.getLiteralConstructorKind() != null) {
                // these literal invocations can not be spurious in ES5
                switch (n.getLiteralConstructorKind()) {
                  case ARRAY:
                    functionValue =
                        Value.makeObject(new ObjectLabel(ECMAScriptObjects.ARRAY, Kind.FUNCTION));
                    break;
                  case REGEXP:
                    functionValue =
                        Value.makeObject(new ObjectLabel(ECMAScriptObjects.REGEXP, Kind.FUNCTION));
                    break;
                  default:
                    throw new AnalysisException(
                        "Unhandled literal constructor type: " + n.getLiteralConstructorKind());
                }
              }
              return functionValue;
            }

            @Override
            public Set<ObjectLabel> prepareThis(State caller_state, State callee_state) {
              return UserFunctionCalls.determineThis(
                  n, caller_state, callee_state, c, n.getBaseRegister());
            }
          },
          state,
          c);
    else { // getPropertyString / getPropertyRegister - like ReadPropertyNode
      Value baseval = state.readRegister(n.getBaseRegister());
      baseval = UnknownValueResolver.getRealValue(baseval, state);
      Set<ObjectLabel> objlabels =
          baseval.getObjectLabels(); // the ReadPropertyNode has updated baseval to account for
      // ToObject
      Value propertyval;
      int propertyreg;
      if (n.isPropertyFixed()) {
        propertyreg = AbstractNode.NO_VALUE;
        propertyval = Value.makeStr(n.getPropertyString());
      } else {
        propertyreg = n.getPropertyRegister();
        propertyval = state.readRegister(propertyreg);
        propertyval = UnknownValueResolver.getRealValue(propertyval, state);
      }
      boolean maybe_undef = propertyval.isMaybeUndef();
      boolean maybe_null = propertyval.isMaybeNull();
      boolean maybe_nan = propertyval.isMaybeNaN();
      propertyval = propertyval.restrictToNotNullNotUndef().restrictToNotNaN();
      Str propertystr = Conversion.toString(propertyval, propertyreg, c);
      // read the object property value, as fixed property name or unknown property name, and
      // separately for "undefined"/"null"/"NaN"
      Map<ObjectLabel, Set<ObjectLabel>> target2this = newMap();
      List<Value> nonfunctions = newList();
      for (ObjectLabel objlabel :
          objlabels) { // find possible targets for each possible base object
        Set<ObjectLabel> singleton = singleton(objlabel);
        Value v;
        boolean read_undefined = false;
        boolean read_null = false;
        boolean read_nan = false;
        if (propertystr.isMaybeSingleStr()) {
          String propertyname = propertystr.getStr();
          v = state.readPropertyValue(singleton, propertyname);
        } else if (!propertystr.isNotStr()) {
          v = state.readPropertyValue(singleton, propertystr);
          read_undefined = propertystr.isMaybeStr("undefined");
          read_null = propertystr.isMaybeStr("null");
          read_nan = propertystr.isMaybeStr("NaN");
        } else v = Value.makeNone();
        if (maybe_undef && !read_undefined) {
          v = UnknownValueResolver.join(v, state.readPropertyValue(singleton, "undefined"), state);
        }
        if (maybe_null && !read_null) {
          v = UnknownValueResolver.join(v, state.readPropertyValue(singleton, "null"), state);
        }
        if (maybe_nan && !read_nan) {
          v = UnknownValueResolver.join(v, state.readPropertyValue(singleton, "NaN"), state);
        }
        v = UnknownValueResolver.getRealValue(v, state);

        // finally, remove all the TAJS hooks, which are spurious if accessed through a dynamic
        // property
        if (!n.isPropertyFixed()) {
          v = JSGlobal.removeTAJSSpecificFunctions(v);
        }

        for (ObjectLabel target : v.getObjectLabels()) {
          if (target.getKind() == Kind.FUNCTION) {
            addToMapSet(target2this, target, objlabel);
          } else {
            nonfunctions.add(Value.makeObject(target));
          }
        }
        if (v.isMaybePrimitive()) {
          nonfunctions.add(v.restrictToNotObject());
        }
      }
      // do calls to each target with the corresponding values of this
      for (Entry<ObjectLabel, Set<ObjectLabel>> me : target2this.entrySet()) {
        ObjectLabel target = me.getKey();
        Set<ObjectLabel> this_objs = me.getValue();
        FunctionCalls.callFunction(
            new OrdinaryCallInfo(n, state) {

              @Override
              public Value getFunctionValue() {
                return Value.makeObject(target);
              }

              @Override
              public Set<ObjectLabel> prepareThis(State caller_state, State callee_state) {
                return this_objs;
              }
            },
            state,
            c);
      }
      // also model calls to non-function values
      FunctionCalls.callFunction(
          new OrdinaryCallInfo(n, state) {

            @Override
            public Value getFunctionValue() {
              return Value.join(nonfunctions);
            }

            @Override
            public Set<ObjectLabel> prepareThis(State caller_state, State callee_state) {
              return Collections.emptySet();
            }
          },
          state,
          c);
    }
  }
Exemplo n.º 28
0
 /** 12.2 variable declaration. */
 @Override
 public void visit(DeclareVariableNode n, State state) {
   state.declareAndWriteVariable(n.getVariableName(), Value.makeUndef(), false);
 }
Exemplo n.º 29
0
 /** 11.2.1 assignment with right-hand-side property accessor. */
 @Override
 public void visit(ReadPropertyNode n, State state) {
   // get the base value, coerce with ToObject
   Value baseval = state.readRegister(n.getBaseRegister());
   baseval = UnknownValueResolver.getRealValue(baseval, state);
   m.visitPropertyAccess(n, baseval);
   Set<ObjectLabel> objlabels = Conversion.toObjectLabels(state, n, baseval, c);
   if (objlabels.isEmpty() && !Options.get().isPropagateDeadFlow()) {
     state.setToNone();
     return;
   }
   state.writeRegister(
       n.getBaseRegister(),
       Value.makeObject(objlabels)); // if null/undefined, an exception would have been thrown via
   // toObjectLabels
   // get the property name value, separate the undefined/null/NaN components, coerce with ToString
   Value propertyval;
   int propertyreg;
   if (n.isPropertyFixed()) {
     propertyreg = AbstractNode.NO_VALUE;
     propertyval = Value.makeStr(n.getPropertyString());
   } else {
     propertyreg = n.getPropertyRegister();
     propertyval = state.readRegister(propertyreg);
     propertyval = UnknownValueResolver.getRealValue(propertyval, state);
   }
   boolean maybe_undef = propertyval.isMaybeUndef();
   boolean maybe_null = propertyval.isMaybeNull();
   boolean maybe_nan = propertyval.isMaybeNaN();
   propertyval = propertyval.restrictToNotNullNotUndef().restrictToNotNaN();
   Str propertystr = Conversion.toString(propertyval, propertyreg, c);
   // read the object property value, as fixed property name or unknown property name, and
   // separately for "undefined"/"null"/"NaN"
   Value v;
   boolean read_undefined = false;
   boolean read_null = false;
   boolean read_nan = false;
   if (propertystr.isMaybeSingleStr()) {
     String propertyname = propertystr.getStr();
     m.visitReadProperty(n, objlabels, propertystr, maybe_undef || maybe_null || maybe_nan, state);
     v = state.readPropertyValue(objlabels, propertyname);
     m.visitPropertyRead(n, objlabels, propertystr, state, true);
   } else if (!propertystr.isNotStr()) {
     m.visitReadProperty(n, objlabels, propertystr, true, state);
     m.visitPropertyRead(n, objlabels, propertystr, state, true);
     v = state.readPropertyValue(objlabels, propertystr);
     read_undefined = propertystr.isMaybeStr("undefined");
     read_null = propertystr.isMaybeStr("null");
     read_nan = propertystr.isMaybeStr("NaN");
   } else v = Value.makeNone();
   if (maybe_undef && !read_undefined) {
     m.visitReadProperty(n, objlabels, Value.makeTemporaryStr("undefined"), true, state);
     v = UnknownValueResolver.join(v, state.readPropertyValue(objlabels, "undefined"), state);
   }
   if (maybe_null && !read_null) {
     m.visitReadProperty(n, objlabels, Value.makeTemporaryStr("null"), true, state);
     v = UnknownValueResolver.join(v, state.readPropertyValue(objlabels, "null"), state);
   }
   if (maybe_nan && !read_nan) {
     m.visitReadProperty(n, objlabels, Value.makeTemporaryStr("NaN"), true, state);
     v = UnknownValueResolver.join(v, state.readPropertyValue(objlabels, "NaN"), state);
   }
   // remove all the TAJS hooks, which are spurious if accessed through a dynamic property
   if (!n.isPropertyFixed()) {
     v = JSGlobal.removeTAJSSpecificFunctions(v);
   }
   m.visitVariableOrProperty(
       n.getPropertyString(), n.getSourceLocation(), v, state.getContext(), state);
   m.visitRead(n, v, state);
   if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) {
     state.setToNone();
     return;
   }
   // store the resulting value
   if (n.getResultRegister() != AbstractNode.NO_VALUE)
     state.writeRegister(n.getResultRegister(), v);
 }
Exemplo n.º 30
0
 /** 11.13 and 11.5/6/7/8 assignment with binary operator. */
 @Override
 public void visit(BinaryOperatorNode n, State state) {
   Value arg1 = state.readRegister(n.getArg1Register());
   Value arg2 = state.readRegister(n.getArg2Register());
   arg1 = UnknownValueResolver.getRealValue(arg1, state);
   arg2 = UnknownValueResolver.getRealValue(arg2, state);
   Value v;
   switch (n.getOperator()) {
     case ADD:
       v =
           Operators.add(
               arg1,
               n.getArg1Register(),
               arg2,
               n.getArg2Register(),
               c); // TODO: test07.js could improve messages if keeping conversions of the two args
       // separate
       break;
     case AND:
       v = Operators.and(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case DIV:
       v = Operators.div(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case EQ:
       v = Operators.eq(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case GE:
       v = Operators.ge(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case GT:
       v = Operators.gt(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case IN:
       v = Operators.in(state, arg1, n.getArg1Register(), arg2, c);
       break;
     case INSTANCEOF:
       v = Operators.instof(state, arg1, arg2, c);
       break;
     case LE:
       v = Operators.le(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case LT:
       v = Operators.lt(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case MUL:
       v = Operators.mul(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case NE:
       v = Operators.neq(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case OR:
       v = Operators.or(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case REM:
       v = Operators.rem(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case SEQ:
       v = Operators.stricteq(arg1, arg2, c);
       break;
     case SHL:
       v = Operators.shl(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case SHR:
       v = Operators.shr(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case SNE:
       v = Operators.strictneq(arg1, arg2, c);
       break;
     case SUB:
       v = Operators.sub(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case USHR:
       v = Operators.ushr(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     case XOR:
       v = Operators.xor(arg1, n.getArg1Register(), arg2, n.getArg2Register(), c);
       break;
     default:
       throw new AnalysisException();
   }
   if (v.isNotPresent() && !Options.get().isPropagateDeadFlow()) {
     state.setToNone();
     return;
   }
   if (n.getResultRegister() != AbstractNode.NO_VALUE)
     state.writeRegister(n.getResultRegister(), v);
 }