| 1 | {"version":3,"sources":["../../src/utils/havoc.js"],"names":["visitName","path","state","name","read","write","scope","hasBinding","unboundReads","add","unboundWrites","ignorePath","parent","t","isLabeledStatement","isBreakStatement","isContinueStatement","HavocedClosureRefVisitor","ReferencedIdentifier","innerName","node","doesRead","operator","getBindingIdentifiers","getHavocedFunctionInfo","value","ECMAScriptSourceFunctionValue","constructor","functionInfo","Set","formalParameters","$FormalParameters","code","$ECMAScriptCode","file","program","expressionStatement","functionExpression","traverse","cache","clear","ObjectValueHavocingVisitor","realm","objectsTrackedForHavoc","visitedValues","getHeapInspector","_heapInspector","undefined","HeapInspector","Logger","mustVisit","val","ObjectValue","has","visitObjectProperty","binding","desc","descriptor","visitDescriptor","visitObjectProperties","obj","kind","propertyBindingValue","symbols","properties","unknownProperty","AbstractValue","visitObjectPropertiesWithComputedNames","visitObjectPrototype","mightNotBeHavocedObject","havoc","size","FatalError","realmGenerator","generator","propertyBinding","canIgnoreProperty","emitPropertyDelete","Value","EmptyValue","targetDescriptor","getTargetIntegrityDescriptor","writable","configurable","emitDefineProperty","emitPropertyAssignment","proto","$Prototype","visitValue","absVal","cond","args","P","V","earlier_props","consequent","alternate","get","set","visitDeclarativeEnvironmentRecordBinding","record","remainingHavocedBindings","bindings","bindingName","Object","keys","isRead","delete","isWritten","visitValueMap","getKind","entries","$MapData","$WeakMapData","len","length","i","entry","key","$Key","$Value","visitValueSet","$SetData","$WeakSetData","visitValueFunction","BoundFunctionValue","$BoundTargetFunction","$BoundThis","boundArg","$BoundArguments","NativeFunctionValue","environment","$Environment","environmentRecord","ObjectEnvironmentRecord","object","GlobalEnvironmentRecord","DeclarativeEnvironmentRecord","FunctionEnvironmentRecord","fn","$FunctionObject","visitValueObject","dateValue","$DateValue","buf","$ViewedArrayBuffer","$ParameterMap","visitValueProxy","$ProxyTarget","$ProxyHandler","visitAbstractValue","mightBeObject","values","isTop","whitelistedKind","startsWith","intrinsicName","n","element","getElements","isIntrinsic","ArrayValue","isIntrinsicAndHasWidenedNumericProperty","PrimitiveValue","ProxyValue","FunctionValue","ensureFrozenValue","loc","diag","CompilerDiagnostic","currentLocation","handleError","HavocImplementation","instantRender","enabled","createdObjectsTrackedForLeaks","visitor"],"mappings":";;;;;;;AAWA;;AAGA;;AAOA;;AAaA;;AACA;;AACA;;AAGA;;AACA;;AACA;;AACA;;;;;;AA1CA;;;;;;;;;AASA;AAwCA,SAASA,SAAT,CACEC,IADF,EAEEC,KAFF,EAGEC,IAHF,EAIEC,IAJF,EAKEC,KALF,EAMQ;AACN;AACA,MAAIJ,KAAKK,KAAL,CAAWC,UAAX,CAAsBJ,IAAtB;AAA4B;AAAc,MAA1C,CAAJ,EAAqD,OAF/C,CAIN;;AACA,MAAIC,IAAJ,EAAUF,MAAMM,YAAN,CAAmBC,GAAnB,CAAuBN,IAAvB;AACV,MAAIE,KAAJ,EAAWH,MAAMQ,aAAN,CAAoBD,GAApB,CAAwBN,IAAxB;AACZ;;AAED,SAASQ,UAAT,CAAoBV,IAApB,EAAsD;AACpD,MAAIW,SAASX,KAAKW,MAAlB;AACA,SAAOC,EAAEC,kBAAF,CAAqBF,MAArB,KAAgCC,EAAEE,gBAAF,CAAmBH,MAAnB,CAAhC,IAA8DC,EAAEG,mBAAF,CAAsBJ,MAAtB,CAArE;AACD;;AAED,IAAIK,2BAA2B;AAC7BC,uBAAqBjB,IAArB,EAA8CC,KAA9C,EAAgF;AAC9E,QAAIS,WAAWV,IAAX,CAAJ,EAAsB;AAEtB,QAAIkB,YAAYlB,KAAKmB,IAAL,CAAUjB,IAA1B;;AACA,QAAIgB,cAAc,WAAlB,EAA+B;AAC7B;AACD;;AACDnB,cAAUC,IAAV,EAAgBC,KAAhB,EAAuBiB,SAAvB,EAAkC,IAAlC,EAAwC,KAAxC;AACD,GAT4B;;AAW7B,0CAAwClB,IAAxC,EAAiEC,KAAjE,EAAmG;AACjG,QAAImB,WAAWpB,KAAKmB,IAAL,CAAUE,QAAV,KAAuB,GAAtC;;AACA,SAAK,IAAInB,IAAT,IAAiBF,KAAKsB,qBAAL,EAAjB,EAA+C;AAC7CvB,gBAAUC,IAAV,EAAgBC,KAAhB,EAAuBC,IAAvB,EAA6BkB,QAA7B,EAAuC,IAAvC;AACD;AACF;;AAhB4B,CAA/B;;AAmBA,SAASG,sBAAT,CAAgCC,KAAhC,EAAsD;AACpD;AACA;AACA;AACA,0BAAUA,iBAAiBC,oCAA3B;AACA,0BAAUD,MAAME,WAAN,KAAsBD,oCAAhC;AACA,MAAIE,eAAe;AACjBpB,kBAAc,IAAIqB,GAAJ,EADG;AAEjBnB,mBAAe,IAAImB,GAAJ;AAFE,GAAnB;AAIA,MAAIC,mBAAmBL,MAAMM,iBAA7B;AACA,0BAAUD,oBAAoB,IAA9B;AACA,MAAIE,OAAOP,MAAMQ,eAAjB;AACA,0BAAUD,QAAQ,IAAlB;AAEA,yBACEnB,EAAEqB,IAAF,CAAOrB,EAAEsB,OAAF,CAAU,CAACtB,EAAEuB,mBAAF,CAAsBvB,EAAEwB,kBAAF,CAAqB,IAArB,EAA2BP,gBAA3B,EAA6CE,IAA7C,CAAtB,CAAD,CAAV,CAAP,CADF,EAEEf,wBAFF,EAGE,IAHF,EAIEW,YAJF;;AAMAU,oBAASC,KAAT,CAAeC,KAAf;;AACA,SAAOZ,YAAP;AACD;;AAED,MAAMa,0BAAN,CAAiC;AAE/B;AAEA;AAIAd,cAAYe,KAAZ,EAA0BC,sBAA1B,EAAoE;AAClE,SAAKD,KAAL,GAAaA,KAAb;AACA,SAAKC,sBAAL,GAA8BA,sBAA9B;AACA,SAAKC,aAAL,GAAqB,IAAIf,GAAJ,EAArB;AACD;;AAEDgB,qBAAkC;AAChC,QAAI,KAAKC,cAAL,KAAwBC,SAA5B,EACE,KAAKD,cAAL,GAAsB,IAAIE,4BAAJ,CAAkB,KAAKN,KAAvB,EAA8B,IAAIO,cAAJ,CAAW,KAAKP,KAAhB;AAAuB;AAAkB,SAAzC,CAA9B,CAAtB;AACF,WAAO,KAAKI,cAAZ;AACD;;AAEDI,YAAUC,GAAV,EAA+B;AAC7B,QAAIA,eAAeC,kBAAnB,EAAgC;AAC9B;AACA;AACA;AACA,UAAI,CAAC,KAAKT,sBAAL,CAA4BU,GAA5B,CAAgCF,GAAhC,CAAL,EAA2C,OAAO,KAAP;AAC5C;;AACD,QAAI,KAAKP,aAAL,CAAmBS,GAAnB,CAAuBF,GAAvB,CAAJ,EAAiC,OAAO,KAAP;AACjC,SAAKP,aAAL,CAAmBnC,GAAnB,CAAuB0C,GAAvB;AACA,WAAO,IAAP;AACD;;AAEDG,sBAAoBC,OAApB,EAAoD;AAClD,QAAIC,OAAOD,QAAQE,UAAnB;AACA,QAAID,SAAST,SAAb,EAAwB,OAF0B,CAElB;;AAChC,SAAKW,eAAL,CAAqBF,IAArB;AACD;;AAEDG,wBAAsBC,GAAtB,EAAwCC,IAAxC,EAAiE;AAC/D;AACA,SAAK,IAAI,GAAGC,oBAAH,CAAT,IAAqCF,IAAIG,OAAzC,EAAkD;AAChD,8BAAUD,oBAAV;AACA,WAAKR,mBAAL,CAAyBQ,oBAAzB;AACD,KAL8D,CAO/D;;;AACA,SAAK,IAAI,GAAGA,oBAAH,CAAT,IAAqCF,IAAII,UAAzC,EAAqD;AACnD,8BAAUF,oBAAV;AACA,WAAKR,mBAAL,CAAyBQ,oBAAzB;AACD,KAX8D,CAa/D;;;AACA,QAAIF,IAAIK,eAAJ,KAAwBlB,SAA5B,EAAuC;AACrC,UAAIS,OAAOI,IAAIK,eAAJ,CAAoBR,UAA/B;;AACA,UAAID,SAAST,SAAb,EAAwB;AACtB,YAAII,MAAMK,KAAK/B,KAAf;AACA,gCAAU0B,eAAee,oBAAzB;AACA,aAAKC,sCAAL,CAA4ChB,GAA5C;AACD;AACF,KArB8D,CAuB/D;;;AACA,SAAKiB,oBAAL,CAA0BR,GAA1B;AAEA,QAAI,gCAAmB,KAAKlB,KAAxB,EAA+BkB,GAA/B,EAAoC,QAApC,CAAJ,EAAmD,OA1BY,CA4B/D;AACA;;AACA,QAAIA,IAAIS,uBAAJ,EAAJ,EAAmC;AACjCT,UAAIU,KAAJ;;AACA,UAAIV,IAAIG,OAAJ,CAAYQ,IAAZ,GAAmB,CAAvB,EAA0B;AACxB,cAAM,IAAIC,kBAAJ,CAAe,6CAAf,CAAN;AACD;;AACD,UAAIZ,IAAIK,eAAJ,KAAwBlB,SAA5B,EAAuC,CAGtC,CAHD,CACE;AACA;AAEF;;;AACA,UAAI0B,iBAAiB,KAAK/B,KAAL,CAAWgC,SAAhC;;AACA,WAAK,IAAI,CAACvE,IAAD,EAAOwE,eAAP,CAAT,IAAoCf,IAAII,UAAxC,EAAoD;AAClD;AACA,YAAI,KAAKnB,gBAAL,GAAwB+B,iBAAxB,CAA0ChB,GAA1C,EAA+CzD,IAA/C,CAAJ,EAA0D;AAE1D,YAAIsD,aAAakB,gBAAgBlB,UAAjC;;AACA,YAAIA,eAAeV,SAAnB,EAA8B;AAC5B;AACA;AACA,cAAI0B,mBAAmB1B,SAAvB,EAAkC0B,eAAeI,kBAAf,CAAkCjB,GAAlC,EAAuCzD,IAAvC;AACnC,SAJD,MAIO;AACL,cAAIsB,QAAQgC,WAAWhC,KAAvB;AACA,kCACEA,UAAUsB,SAAV,IAAuBtB,iBAAiBqD,YAD1C,EAEE,oEAFF;;AAIA,cAAIrD,UAAUsB,SAAd,EAAyB,CACvB;AACA;AACD,WAHD,MAGO;AACL,oCAAUtB,iBAAiBqD,YAA3B;;AACA,gBAAIrD,iBAAiBsD,iBAArB,EAAiC;AAC/B,kBAAIN,mBAAmB1B,SAAvB,EAAkC0B,eAAeI,kBAAf,CAAkCjB,GAAlC,EAAuCzD,IAAvC;AACnC,aAFD,MAEO;AACL,kBAAIsE,mBAAmB1B,SAAvB,EAAkC;AAChC,oBAAIiC,mBAAmB,KAAKnC,gBAAL,GAAwBoC,4BAAxB,CAAqDrB,GAArD,CAAvB;;AACA,oBAAI,CAAC,2BAAeA,GAAf,CAAL,EAA0B;AACxB,sBACEH,WAAWyB,QAAX,KAAwBF,iBAAiBE,QAAzC,IACAzB,WAAW0B,YAAX,KAA4BH,iBAAiBG,YAF/C,EAGE;AACAV,mCAAeW,kBAAf,CAAkCxB,GAAlC,EAAuCzD,IAAvC,EAA6CsD,UAA7C;AACD,mBALD,MAKO;AACLgB,mCAAeY,sBAAf,CAAsCzB,GAAtC,EAA2CzD,IAA3C,EAAiDsB,KAAjD;AACD;AACF;AACF;AACF;AACF;AACF;AACF;AACF;AACF;;AAED2C,uBAAqBR,GAArB,EAA6C;AAC3C,QAAI0B,QAAQ1B,IAAI2B,UAAhB;AACA,SAAKC,UAAL,CAAgBF,KAAhB;AACD;;AAEDnB,yCAAuCsB,MAAvC,EAAoE;AAClE,QAAIA,OAAO5B,IAAP,KAAgB,kBAApB,EAAwC;AACxC,QAAI4B,OAAO5B,IAAP,KAAgB,0CAApB,EAAgE;;AAChE,QAAI4B,OAAO5B,IAAP,KAAgB,aAApB,EAAmC;AACjC,UAAI6B,OAAOD,OAAOE,IAAP,CAAY,CAAZ,CAAX;AACA,8BAAUD,gBAAgBxB,oBAA1B;;AACA,UAAIwB,KAAK7B,IAAL,KAAc,sCAAlB,EAA0D;AACxD,YAAI+B,IAAIF,KAAKC,IAAL,CAAU,CAAV,CAAR;AACA,gCAAUC,aAAa1B,oBAAvB;AACA,YAAI2B,IAAIJ,OAAOE,IAAP,CAAY,CAAZ,CAAR;AACA,YAAIG,gBAAgBL,OAAOE,IAAP,CAAY,CAAZ,CAApB;AACA,YAAIG,yBAAyB5B,oBAA7B,EAA4C,KAAKC,sCAAL,CAA4C2B,aAA5C;AAC5C,aAAKN,UAAL,CAAgBI,CAAhB;AACA,aAAKJ,UAAL,CAAgBK,CAAhB;AACD,OARD,MAQO;AACL;AACA,aAAKL,UAAL,CAAgBE,IAAhB;AACA,YAAIK,aAAaN,OAAOE,IAAP,CAAY,CAAZ,CAAjB;;AACA,YAAII,sBAAsB7B,oBAA1B,EAAyC;AACvC,eAAKC,sCAAL,CAA4C4B,UAA5C;AACD;;AACD,YAAIC,YAAYP,OAAOE,IAAP,CAAY,CAAZ,CAAhB;;AACA,YAAIK,qBAAqB9B,oBAAzB,EAAwC;AACtC,eAAKC,sCAAL,CAA4C6B,SAA5C;AACD;AACF;AACF,KAvBD,MAuBO;AACL,WAAKR,UAAL,CAAgBC,MAAhB;AACD;AACF;;AAED/B,kBAAgBF,IAAhB,EAAwC;AACtC,4BAAUA,KAAK/B,KAAL,KAAesB,SAAf,IAA4BS,KAAK/B,KAAL,YAAsBqD,YAA5D;AACA,QAAItB,KAAK/B,KAAL,KAAesB,SAAnB,EAA8B,KAAKyC,UAAL,CAAgBhC,KAAK/B,KAArB;AAC9B,QAAI+B,KAAKyC,GAAL,KAAalD,SAAjB,EAA4B,KAAKyC,UAAL,CAAgBhC,KAAKyC,GAArB;AAC5B,QAAIzC,KAAK0C,GAAL,KAAanD,SAAjB,EAA4B,KAAKyC,UAAL,CAAgBhC,KAAK0C,GAArB;AAC7B;;AAEDC,2CACEC,MADF,EAEEC,wBAFF,EAGQ;AACN,QAAIC,WAAWF,OAAOE,QAAtB;;AACA,SAAK,IAAIC,WAAT,IAAwBC,OAAOC,IAAP,CAAYH,QAAZ,CAAxB,EAA+C;AAC7C,UAAI/C,UAAU+C,SAASC,WAAT,CAAd,CAD6C,CAE7C;;AACA,UAAIG,SAASL,yBAAyB7F,YAAzB,CAAsCmG,MAAtC,CAA6CJ,WAA7C,CAAb;AACA,UAAIK,YAAYP,yBAAyB3F,aAAzB,CAAuCiG,MAAvC,CAA8CJ,WAA9C,CAAhB;;AACA,UAAIG,MAAJ,EAAY;AACV;AACA,YAAIjF,QAAQ8B,QAAQ9B,KAApB;;AACA,YAAIA,KAAJ,EAAW;AACT,eAAK+D,UAAL,CAAgB/D,KAAhB;AACD;AACF;;AACD,UAAImF,aAAaF,MAAjB,EAAyB;AACvB;AACA;AACA;AACA;AACA;AACA;AACA,uCAAanD,OAAb;AACD;AACF;AACF;;AAEDsD,gBAAc1D,GAAd,EAAsC;AACpC,QAAIU,OAAOV,IAAI2D,OAAJ,EAAX;AAEA,QAAIC,OAAJ;;AACA,QAAIlD,SAAS,KAAb,EAAoB;AAClBkD,gBAAU5D,IAAI6D,QAAd;AACD,KAFD,MAEO;AACL,8BAAUnD,SAAS,SAAnB;AACAkD,gBAAU5D,IAAI8D,YAAd;AACD;;AACD,4BAAUF,YAAYhE,SAAtB;AACA,QAAImE,MAAMH,QAAQI,MAAlB;;AAEA,SAAK,IAAIC,IAAI,CAAb,EAAgBA,IAAIF,GAApB,EAAyBE,GAAzB,EAA8B;AAC5B,UAAIC,QAAQN,QAAQK,CAAR,CAAZ;AACA,UAAIE,MAAMD,MAAME,IAAhB;AACA,UAAI9F,QAAQ4F,MAAMG,MAAlB;AACA,UAAIF,QAAQvE,SAAR,IAAqBtB,UAAUsB,SAAnC,EAA8C;AAC9C,WAAKyC,UAAL,CAAgB8B,GAAhB;AACA,WAAK9B,UAAL,CAAgB/D,KAAhB;AACD;AACF;;AAEDgG,gBAActE,GAAd,EAAsC;AACpC,QAAIU,OAAOV,IAAI2D,OAAJ,EAAX;AAEA,QAAIC,OAAJ;;AACA,QAAIlD,SAAS,KAAb,EAAoB;AAClBkD,gBAAU5D,IAAIuE,QAAd;AACD,KAFD,MAEO;AACL,8BAAU7D,SAAS,SAAnB;AACAkD,gBAAU5D,IAAIwE,YAAd;AACD;;AACD,4BAAUZ,YAAYhE,SAAtB;AACA,QAAImE,MAAMH,QAAQI,MAAlB;;AAEA,SAAK,IAAIC,IAAI,CAAb,EAAgBA,IAAIF,GAApB,EAAyBE,GAAzB,EAA8B;AAC5B,UAAIC,QAAQN,QAAQK,CAAR,CAAZ;AACA,UAAIC,UAAUtE,SAAd,EAAyB;AACzB,WAAKyC,UAAL,CAAgB6B,KAAhB;AACD;AACF;;AAEDO,qBAAmBzE,GAAnB,EAA6C;AAC3C,QAAI,CAACA,IAAIkB,uBAAJ,EAAL,EAAoC;AAClC;AACD;;AACD,SAAKV,qBAAL,CAA2BR,GAA3B;;AAEA,QAAIA,eAAe0E,yBAAnB,EAAuC;AACrC,WAAKrC,UAAL,CAAgBrC,IAAI2E,oBAApB;AACA,WAAKtC,UAAL,CAAgBrC,IAAI4E,UAApB;;AACA,WAAK,IAAIC,QAAT,IAAqB7E,IAAI8E,eAAzB,EAA0C,KAAKzC,UAAL,CAAgBwC,QAAhB;;AAC1C;AACD;;AAED,4BACE,EAAE7E,eAAe+E,0BAAjB,CADF,EAEE,wFAFF;AAKA,QAAI7B,2BAA2B7E,uBAAuB2B,GAAvB,CAA/B;AAEA,QAAIgF,cAAchF,IAAIiF,YAAtB;;AACA,WAAOD,WAAP,EAAoB;AAClB,UAAI/B,SAAS+B,YAAYE,iBAAzB;;AACA,UAAIjC,kBAAkBkC,oCAAtB,EAA+C;AAC7C,aAAK9C,UAAL,CAAgBY,OAAOmC,MAAvB;AACA;AACD;;AACD,UAAInC,kBAAkBoC,oCAAtB,EAA+C;AAC7C;AACD;;AAED,8BAAUpC,kBAAkBqC,yCAA5B;AACA,WAAKtC,wCAAL,CAA8CC,MAA9C,EAAsDC,wBAAtD;;AAEA,UAAID,kBAAkBsC,sCAAtB,EAAiD;AAC/C;AACA;AACA;AACA,YAAIC,KAAKvC,OAAOwC,eAAhB;;AACA,YAAI,CAAC,KAAKjG,sBAAL,CAA4BU,GAA5B,CAAgCsF,EAAhC,CAAL,EAA0C;AACxC;AACD;AACF;;AACDR,oBAAcA,YAAYvH,MAA1B;AACD;AACF;;AAEDiI,mBAAiB1F,GAAjB,EAAyC;AACvC,QAAI,CAACA,IAAIkB,uBAAJ,EAAL,EAAoC;AAClC;AACD;;AAED,QAAIR,OAAOV,IAAI2D,OAAJ,EAAX;AACA,SAAKnD,qBAAL,CAA2BR,GAA3B,EAAgCU,IAAhC;;AAEA,YAAQA,IAAR;AACE,WAAK,QAAL;AACA,WAAK,QAAL;AACA,WAAK,QAAL;AACA,WAAK,SAAL;AACA,WAAK,cAAL;AACA,WAAK,aAAL;AACA,WAAK,OAAL;AACE;;AACF,WAAK,MAAL;AACE,YAAIiF,YAAY3F,IAAI4F,UAApB;AACA,gCAAUD,cAAc/F,SAAxB;AACA,aAAKyC,UAAL,CAAgBsD,SAAhB;AACA;;AACF,WAAK,cAAL;AACA,WAAK,cAAL;AACA,WAAK,WAAL;AACA,WAAK,YAAL;AACA,WAAK,YAAL;AACA,WAAK,YAAL;AACA,WAAK,aAAL;AACA,WAAK,aAAL;AACA,WAAK,mBAAL;AACA,WAAK,UAAL;AACE,YAAIE,MAAM7F,IAAI8F,kBAAd;AACA,gCAAUD,QAAQjG,SAAlB;AACA,aAAKyC,UAAL,CAAgBwD,GAAhB;AACA;;AACF,WAAK,KAAL;AACA,WAAK,SAAL;AACE,aAAKnC,aAAL,CAAmB1D,GAAnB;AACA;;AACF,WAAK,KAAL;AACA,WAAK,SAAL;AACE,aAAKsE,aAAL,CAAmBtE,GAAnB;AACA;;AACF;AACE,gCAAUU,SAAS,QAAnB,EAA8B,kBAAiBA,IAAK,mDAApD;AACA,gCAAUV,IAAI+F,aAAJ,KAAsBnG,SAAhC,EAA4C,mEAA5C;AACA;AAvCJ;AAyCD;;AAEDoG,kBAAgBhG,GAAhB,EAAuC;AACrC,SAAKqC,UAAL,CAAgBrC,IAAIiG,YAApB;AACA,SAAK5D,UAAL,CAAgBrC,IAAIkG,aAApB;AACD;;AAEDC,qBAAmBnG,GAAnB,EAA6C;AAC3C,QAAI,CAACA,IAAIoG,aAAJ,EAAL,EAA0B;AACxB;AACA;AACD;;AACD,QAAIpG,IAAIqG,MAAJ,CAAWC,KAAX,EAAJ,EAAwB;AACtB;AACA;AACA;AAEA,UAAItG,IAAIU,IAAJ,KAAa,aAAjB,EAAgC;AAC9B;AACA,aAAK2B,UAAL,CAAgBrC,IAAIwC,IAAJ,CAAS,CAAT,CAAhB;AACA,aAAKH,UAAL,CAAgBrC,IAAIwC,IAAJ,CAAS,CAAT,CAAhB;AACA;AACD,OAVqB,CAYtB;AACA;;;AACA,UAAI+D,kBACFvG,IAAIU,IAAJ,KACCV,IAAIU,IAAJ,KAAa,0BAAb,IAA2C;AAC1CV,UAAIU,IAAJ,CAAS8F,UAAT,CAAoB,iBAApB,CAFF,CADF;AAIA,8BACED,mBAAmBvG,IAAIyG,aAAvB,IAAwCzG,IAAIwC,IAAJ,CAASwB,MAAT,GAAkB,CAD5D,EAEE,qDAFF,EAlBsB,CAuBtB;AACA;AACA;;AACA,WAAK,IAAIC,IAAI,CAAR,EAAWyC,IAAI1G,IAAIwC,IAAJ,CAASwB,MAA7B,EAAqCC,IAAIyC,CAAzC,EAA4CzC,GAA5C,EAAiD;AAC/C,aAAK5B,UAAL,CAAgBrC,IAAIwC,IAAJ,CAASyB,CAAT,CAAhB;AACD;;AACD;AACD,KAnC0C,CAoC3C;;;AACA,SAAK,IAAI0C,OAAT,IAAoB3G,IAAIqG,MAAJ,CAAWO,WAAX,EAApB,EAA8C;AAC5C,WAAKvE,UAAL,CAAgBsE,OAAhB;AACD;AACF;;AAEDtE,aAAWrC,GAAX,EAA6B;AAC3B,QAAIA,eAAee,oBAAnB,EAAkC;AAChC,UAAI,KAAKhB,SAAL,CAAeC,GAAf,CAAJ,EAAyB,KAAKmG,kBAAL,CAAwBnG,GAAxB;AAC1B,KAFD,MAEO,IAAIA,IAAI6G,WAAJ,EAAJ,EAAuB;AAC5B;AACA;AACA,UAAI7G,eAAe8G,iBAAf,IAA6BA,kBAAWC,uCAAX,CAAmD/G,GAAnD,CAAjC,EAA0F;AACxF,YAAI,KAAKD,SAAL,CAAeC,GAAf,CAAJ,EAAyB,KAAK0F,gBAAL,CAAsB1F,GAAtB;AAC1B,OAFD,MAEO;AACL,aAAKD,SAAL,CAAeC,GAAf;AACD;AACF,KARM,MAQA,IAAIA,eAAe4B,iBAAnB,EAA+B;AACpC,WAAK7B,SAAL,CAAeC,GAAf;AACD,KAFM,MAEA,IAAIA,eAAegH,qBAAnB,EAAmC;AACxC,WAAKjH,SAAL,CAAeC,GAAf;AACD,KAFM,MAEA,IAAIA,eAAeiH,iBAAnB,EAA+B;AACpC,UAAI,KAAKlH,SAAL,CAAeC,GAAf,CAAJ,EAAyB,KAAKgG,eAAL,CAAqBhG,GAArB;AAC1B,KAFM,MAEA,IAAIA,eAAekH,oBAAnB,EAAkC;AACvC,8BAAUlH,eAAekH,oBAAzB;AACA,UAAI,KAAKnH,SAAL,CAAeC,GAAf,CAAJ,EAAyB,KAAKyE,kBAAL,CAAwBzE,GAAxB;AAC1B,KAHM,MAGA;AACL,8BAAUA,eAAeC,kBAAzB;AACA,UAAI,KAAKF,SAAL,CAAeC,GAAf,CAAJ,EAAyB,KAAK0F,gBAAL,CAAsB1F,GAAtB;AAC1B;AACF;;AAtZ8B;;AAyZjC,SAASmH,iBAAT,CAA2B5H,KAA3B,EAAkCjB,KAAlC,EAAyC8I,GAAzC,EAAoD;AAClD;AACA,MAAI9I,iBAAiB2B,kBAAjB,IAAgC,CAAC,gCAAmBV,KAAnB,EAA0BjB,KAA1B,EAAiC,QAAjC,CAArC,EAAiF;AAC/E,QAAI+I,OAAO,IAAIC,0BAAJ,CACT,kDADS,EAETF,OAAO7H,MAAMgI,eAFJ,EAGT,QAHS,EAIT,kBAJS,CAAX;AAMA,QAAIhI,MAAMiI,WAAN,CAAkBH,IAAlB,MAA4B,SAAhC,EAA2C,MAAM,IAAIhG,kBAAJ,EAAN;AAC5C;AACF,C,CAED;AACA;;;AACO,MAAMoG,mBAAN,CAA0B;AAC/BnJ,QAAMiB,KAAN,EAAoBjB,KAApB,EAAkC8I,GAAlC,EAAuE;AACrE,QAAI7H,MAAMmI,aAAN,CAAoBC,OAAxB,EAAiC;AAC/B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACD;;AACD,QAAInI,yBAAyBD,MAAMqI,6BAAnC;;AACA,QAAIpI,2BAA2BI,SAA/B,EAA0C;AACxC;AACA;AACA;AACAuH,wBAAkB5H,KAAlB,EAAyBjB,KAAzB,EAAgC8I,GAAhC;AACD,KALD,MAKO;AACL;AACA;AACA;AACA;AACA;AACA,UAAIS,UAAU,IAAIvI,0BAAJ,CAA+BC,KAA/B,EAAsCC,sBAAtC,CAAd;AACAqI,cAAQxF,UAAR,CAAmB/D,KAAnB;AACD;AACF;;AA3B8B","sourcesContent":["/**\n * Copyright (c) 2017-present, Facebook, Inc.\n * All rights reserved.\n *\n * This source code is licensed under the BSD-style license found in the\n * LICENSE file in the root directory of this source tree. An additional grant\n * of patent rights can be found in the PATENTS file in the same directory.\n */\n\n/* @flow strict-local */\n\nimport { CompilerDiagnostic, FatalError } from \"../errors.js\";\nimport type { Realm } from \"../realm.js\";\nimport type { Descriptor, PropertyBinding, ObjectKind } from \"../types.js\";\nimport {\n havocBinding,\n DeclarativeEnvironmentRecord,\n FunctionEnvironmentRecord,\n ObjectEnvironmentRecord,\n GlobalEnvironmentRecord,\n} from \"../environment.js\";\nimport {\n AbstractValue,\n ArrayValue,\n BoundFunctionValue,\n ECMAScriptSourceFunctionValue,\n EmptyValue,\n FunctionValue,\n NativeFunctionValue,\n ObjectValue,\n PrimitiveValue,\n ProxyValue,\n Value,\n} from \"../values/index.js\";\nimport { TestIntegrityLevel } from \"../methods/index.js\";\nimport * as t from \"@babel/types\";\nimport traverse from \"@babel/traverse\";\nimport type { BabelTraversePath } from \"@babel/traverse\";\nimport type { BabelNodeSourceLocation } from \"@babel/types\";\nimport invariant from \"../invariant.js\";\nimport { HeapInspector } from \"../utils/HeapInspector.js\";\nimport { Logger } from \"../utils/logger.js\";\nimport { isReactElement } from \"../react/utils.js\";\n\ntype HavocedFunctionInfo = {\n unboundReads: Set<string>,\n unboundWrites: Set<string>,\n};\n\nfunction visitName(\n path: BabelTraversePath,\n state: HavocedFunctionInfo,\n name: string,\n read: boolean,\n write: boolean\n): void {\n // Is the name bound to some local identifier? If so, we don't need to do anything\n if (path.scope.hasBinding(name, /*noGlobals*/ true)) return;\n\n // Otherwise, let's record that there's an unbound identifier\n if (read) state.unboundReads.add(name);\n if (write) state.unboundWrites.add(name);\n}\n\nfunction ignorePath(path: BabelTraversePath): boolean {\n let parent = path.parent;\n return t.isLabeledStatement(parent) || t.isBreakStatement(parent) || t.isContinueStatement(parent);\n}\n\nlet HavocedClosureRefVisitor = {\n ReferencedIdentifier(path: BabelTraversePath, state: HavocedFunctionInfo): void {\n if (ignorePath(path)) return;\n\n let innerName = path.node.name;\n if (innerName === \"arguments\") {\n return;\n }\n visitName(path, state, innerName, true, false);\n },\n\n \"AssignmentExpression|UpdateExpression\"(path: BabelTraversePath, state: HavocedFunctionInfo): void {\n let doesRead = path.node.operator !== \"=\";\n for (let name in path.getBindingIdentifiers()) {\n visitName(path, state, name, doesRead, true);\n }\n },\n};\n\nfunction getHavocedFunctionInfo(value: FunctionValue) {\n // TODO: This should really be cached on a per AST basis in case we have\n // many uses of the same closure. It should ideally share this cache\n // and data with ResidualHeapVisitor.\n invariant(value instanceof ECMAScriptSourceFunctionValue);\n invariant(value.constructor === ECMAScriptSourceFunctionValue);\n let functionInfo = {\n unboundReads: new Set(),\n unboundWrites: new Set(),\n };\n let formalParameters = value.$FormalParameters;\n invariant(formalParameters != null);\n let code = value.$ECMAScriptCode;\n invariant(code != null);\n\n traverse(\n t.file(t.program([t.expressionStatement(t.functionExpression(null, formalParameters, code))])),\n HavocedClosureRefVisitor,\n null,\n functionInfo\n );\n traverse.cache.clear();\n return functionInfo;\n}\n\nclass ObjectValueHavocingVisitor {\n realm: Realm;\n // ObjectValues to visit if they're reachable.\n objectsTrackedForHavoc: Set<ObjectValue>;\n // Values that has been visited.\n visitedValues: Set<Value>;\n _heapInspector: HeapInspector;\n\n constructor(realm: Realm, objectsTrackedForHavoc: Set<ObjectValue>) {\n this.realm = realm;\n this.objectsTrackedForHavoc = objectsTrackedForHavoc;\n this.visitedValues = new Set();\n }\n\n getHeapInspector(): HeapInspector {\n if (this._heapInspector === undefined)\n this._heapInspector = new HeapInspector(this.realm, new Logger(this.realm, /*internalDebug*/ false));\n return this._heapInspector;\n }\n\n mustVisit(val: Value): boolean {\n if (val instanceof ObjectValue) {\n // For Objects we only need to visit it if it is tracked\n // as a newly created object that might still be mutated.\n // Abstract values gets their arguments visited.\n if (!this.objectsTrackedForHavoc.has(val)) return false;\n }\n if (this.visitedValues.has(val)) return false;\n this.visitedValues.add(val);\n return true;\n }\n\n visitObjectProperty(binding: PropertyBinding): void {\n let desc = binding.descriptor;\n if (desc === undefined) return; //deleted\n this.visitDescriptor(desc);\n }\n\n visitObjectProperties(obj: ObjectValue, kind?: ObjectKind): void {\n // visit symbol properties\n for (let [, propertyBindingValue] of obj.symbols) {\n invariant(propertyBindingValue);\n this.visitObjectProperty(propertyBindingValue);\n }\n\n // visit string properties\n for (let [, propertyBindingValue] of obj.properties) {\n invariant(propertyBindingValue);\n this.visitObjectProperty(propertyBindingValue);\n }\n\n // inject properties with computed names\n if (obj.unknownProperty !== undefined) {\n let desc = obj.unknownProperty.descriptor;\n if (desc !== undefined) {\n let val = desc.value;\n invariant(val instanceof AbstractValue);\n this.visitObjectPropertiesWithComputedNames(val);\n }\n }\n\n // prototype\n this.visitObjectPrototype(obj);\n\n if (TestIntegrityLevel(this.realm, obj, \"frozen\")) return;\n\n // if this object wasn't already havoced, we need mark it as havoced\n // so that any mutation and property access get tracked after this.\n if (obj.mightNotBeHavocedObject()) {\n obj.havoc();\n if (obj.symbols.size > 0) {\n throw new FatalError(\"TODO: Support havocing objects with symbols\");\n }\n if (obj.unknownProperty !== undefined) {\n // TODO: Support unknown properties, or throw FatalError.\n // We have repros, e.g. test/serializer/additional-functions/ArrayConcat.js.\n }\n // TODO: We should emit current value and then reset value for all *internal slots*; this will require deep serializer support; or throw FatalError when we detect any non-initial values in internal slots.\n let realmGenerator = this.realm.generator;\n for (let [name, propertyBinding] of obj.properties) {\n // ignore properties with their correct default values\n if (this.getHeapInspector().canIgnoreProperty(obj, name)) continue;\n\n let descriptor = propertyBinding.descriptor;\n if (descriptor === undefined) {\n // TODO: This happens, e.g. test/serializer/pure-functions/ObjectAssign2.js\n // If it indeed means deleted binding, should we initialize descriptor with a deleted value?\n if (realmGenerator !== undefined) realmGenerator.emitPropertyDelete(obj, name);\n } else {\n let value = descriptor.value;\n invariant(\n value === undefined || value instanceof Value,\n \"cannot be an array because we are not dealing with intrinsics here\"\n );\n if (value === undefined) {\n // TODO: Deal with accessor properties\n // We have repros, e.g. test/serializer/pure-functions/AbstractPropertyObjectKeyAssignment.js\n } else {\n invariant(value instanceof Value);\n if (value instanceof EmptyValue) {\n if (realmGenerator !== undefined) realmGenerator.emitPropertyDelete(obj, name);\n } else {\n if (realmGenerator !== undefined) {\n let targetDescriptor = this.getHeapInspector().getTargetIntegrityDescriptor(obj);\n if (!isReactElement(obj)) {\n if (\n descriptor.writable !== targetDescriptor.writable ||\n descriptor.configurable !== targetDescriptor.configurable\n ) {\n realmGenerator.emitDefineProperty(obj, name, descriptor);\n } else {\n realmGenerator.emitPropertyAssignment(obj, name, value);\n }\n }\n }\n }\n }\n }\n }\n }\n }\n\n visitObjectPrototype(obj: ObjectValue): void {\n let proto = obj.$Prototype;\n this.visitValue(proto);\n }\n\n visitObjectPropertiesWithComputedNames(absVal: AbstractValue): void {\n if (absVal.kind === \"widened property\") return;\n if (absVal.kind === \"template for prototype member expression\") return;\n if (absVal.kind === \"conditional\") {\n let cond = absVal.args[0];\n invariant(cond instanceof AbstractValue);\n if (cond.kind === \"template for property name condition\") {\n let P = cond.args[0];\n invariant(P instanceof AbstractValue);\n let V = absVal.args[1];\n let earlier_props = absVal.args[2];\n if (earlier_props instanceof AbstractValue) this.visitObjectPropertiesWithComputedNames(earlier_props);\n this.visitValue(P);\n this.visitValue(V);\n } else {\n // conditional assignment\n this.visitValue(cond);\n let consequent = absVal.args[1];\n if (consequent instanceof AbstractValue) {\n this.visitObjectPropertiesWithComputedNames(consequent);\n }\n let alternate = absVal.args[2];\n if (alternate instanceof AbstractValue) {\n this.visitObjectPropertiesWithComputedNames(alternate);\n }\n }\n } else {\n this.visitValue(absVal);\n }\n }\n\n visitDescriptor(desc: Descriptor): void {\n invariant(desc.value === undefined || desc.value instanceof Value);\n if (desc.value !== undefined) this.visitValue(desc.value);\n if (desc.get !== undefined) this.visitValue(desc.get);\n if (desc.set !== undefined) this.visitValue(desc.set);\n }\n\n visitDeclarativeEnvironmentRecordBinding(\n record: DeclarativeEnvironmentRecord,\n remainingHavocedBindings: HavocedFunctionInfo\n ): void {\n let bindings = record.bindings;\n for (let bindingName of Object.keys(bindings)) {\n let binding = bindings[bindingName];\n // Check if this binding is referenced, and if so delete it from the set.\n let isRead = remainingHavocedBindings.unboundReads.delete(bindingName);\n let isWritten = remainingHavocedBindings.unboundWrites.delete(bindingName);\n if (isRead) {\n // If this binding can be read from the closure, its value has now havoced.\n let value = binding.value;\n if (value) {\n this.visitValue(value);\n }\n }\n if (isWritten || isRead) {\n // If this binding could have been mutated from the closure, then the\n // binding itself has now leaked, but not necessarily the value in it.\n // TODO: We could tag a leaked binding as read and/or write. That way\n // we don't have to havoc values written to this binding if only the binding\n // has been written to. We also don't have to havoc reads from this binding\n // if it is only read from.\n havocBinding(binding);\n }\n }\n }\n\n visitValueMap(val: ObjectValue): void {\n let kind = val.getKind();\n\n let entries;\n if (kind === \"Map\") {\n entries = val.$MapData;\n } else {\n invariant(kind === \"WeakMap\");\n entries = val.$WeakMapData;\n }\n invariant(entries !== undefined);\n let len = entries.length;\n\n for (let i = 0; i < len; i++) {\n let entry = entries[i];\n let key = entry.$Key;\n let value = entry.$Value;\n if (key === undefined || value === undefined) continue;\n this.visitValue(key);\n this.visitValue(value);\n }\n }\n\n visitValueSet(val: ObjectValue): void {\n let kind = val.getKind();\n\n let entries;\n if (kind === \"Set\") {\n entries = val.$SetData;\n } else {\n invariant(kind === \"WeakSet\");\n entries = val.$WeakSetData;\n }\n invariant(entries !== undefined);\n let len = entries.length;\n\n for (let i = 0; i < len; i++) {\n let entry = entries[i];\n if (entry === undefined) continue;\n this.visitValue(entry);\n }\n }\n\n visitValueFunction(val: FunctionValue): void {\n if (!val.mightNotBeHavocedObject()) {\n return;\n }\n this.visitObjectProperties(val);\n\n if (val instanceof BoundFunctionValue) {\n this.visitValue(val.$BoundTargetFunction);\n this.visitValue(val.$BoundThis);\n for (let boundArg of val.$BoundArguments) this.visitValue(boundArg);\n return;\n }\n\n invariant(\n !(val instanceof NativeFunctionValue),\n \"all native function values should have already been created outside this pure function\"\n );\n\n let remainingHavocedBindings = getHavocedFunctionInfo(val);\n\n let environment = val.$Environment;\n while (environment) {\n let record = environment.environmentRecord;\n if (record instanceof ObjectEnvironmentRecord) {\n this.visitValue(record.object);\n continue;\n }\n if (record instanceof GlobalEnvironmentRecord) {\n break;\n }\n\n invariant(record instanceof DeclarativeEnvironmentRecord);\n this.visitDeclarativeEnvironmentRecordBinding(record, remainingHavocedBindings);\n\n if (record instanceof FunctionEnvironmentRecord) {\n // If this is a function environment, which is not tracked for havocs,\n // we can bail out because its bindings should not be mutated in a\n // pure function.\n let fn = record.$FunctionObject;\n if (!this.objectsTrackedForHavoc.has(fn)) {\n break;\n }\n }\n environment = environment.parent;\n }\n }\n\n visitValueObject(val: ObjectValue): void {\n if (!val.mightNotBeHavocedObject()) {\n return;\n }\n\n let kind = val.getKind();\n this.visitObjectProperties(val, kind);\n\n switch (kind) {\n case \"RegExp\":\n case \"Number\":\n case \"String\":\n case \"Boolean\":\n case \"ReactElement\":\n case \"ArrayBuffer\":\n case \"Array\":\n return;\n case \"Date\":\n let dateValue = val.$DateValue;\n invariant(dateValue !== undefined);\n this.visitValue(dateValue);\n return;\n case \"Float32Array\":\n case \"Float64Array\":\n case \"Int8Array\":\n case \"Int16Array\":\n case \"Int32Array\":\n case \"Uint8Array\":\n case \"Uint16Array\":\n case \"Uint32Array\":\n case \"Uint8ClampedArray\":\n case \"DataView\":\n let buf = val.$ViewedArrayBuffer;\n invariant(buf !== undefined);\n this.visitValue(buf);\n return;\n case \"Map\":\n case \"WeakMap\":\n this.visitValueMap(val);\n return;\n case \"Set\":\n case \"WeakSet\":\n this.visitValueSet(val);\n return;\n default:\n invariant(kind === \"Object\", `Object of kind ${kind} is not supported in calls to abstract functions.`);\n invariant(val.$ParameterMap === undefined, `Arguments object is not supported in calls to abstract functions.`);\n return;\n }\n }\n\n visitValueProxy(val: ProxyValue): void {\n this.visitValue(val.$ProxyTarget);\n this.visitValue(val.$ProxyHandler);\n }\n\n visitAbstractValue(val: AbstractValue): void {\n if (!val.mightBeObject()) {\n // Only objects need to be havoced.\n return;\n }\n if (val.values.isTop()) {\n // If we don't know which object instances it might be,\n // then it might be one of the arguments that created\n // this value. See #2179.\n\n if (val.kind === \"conditional\") {\n // For a conditional, we only have to visit each case. Not the condition itself.\n this.visitValue(val.args[1]);\n this.visitValue(val.args[2]);\n return;\n }\n\n // To ensure that we don't forget to provide arguments\n // that can be havoced, we require at least one argument.\n let whitelistedKind =\n val.kind &&\n (val.kind === \"widened numeric property\" || // TODO: Widened properties needs to be havocable.\n val.kind.startsWith(\"abstractCounted\"));\n invariant(\n whitelistedKind || val.intrinsicName || val.args.length > 0,\n \"Havoced unknown object requires havocable arguments\"\n );\n\n // TODO: This is overly conservative. We recursively havoc all the inputs\n // to this operation whether or not they can possible be part of the\n // result value or not.\n for (let i = 0, n = val.args.length; i < n; i++) {\n this.visitValue(val.args[i]);\n }\n return;\n }\n // If we know which objects this might be, then havoc each of them.\n for (let element of val.values.getElements()) {\n this.visitValue(element);\n }\n }\n\n visitValue(val: Value): void {\n if (val instanceof AbstractValue) {\n if (this.mustVisit(val)) this.visitAbstractValue(val);\n } else if (val.isIntrinsic()) {\n // All intrinsic values exist from the beginning of time (except unknown arrays)...\n // ...except for a few that come into existance as templates for abstract objects.\n if (val instanceof ArrayValue && ArrayValue.isIntrinsicAndHasWidenedNumericProperty(val)) {\n if (this.mustVisit(val)) this.visitValueObject(val);\n } else {\n this.mustVisit(val);\n }\n } else if (val instanceof EmptyValue) {\n this.mustVisit(val);\n } else if (val instanceof PrimitiveValue) {\n this.mustVisit(val);\n } else if (val instanceof ProxyValue) {\n if (this.mustVisit(val)) this.visitValueProxy(val);\n } else if (val instanceof FunctionValue) {\n invariant(val instanceof FunctionValue);\n if (this.mustVisit(val)) this.visitValueFunction(val);\n } else {\n invariant(val instanceof ObjectValue);\n if (this.mustVisit(val)) this.visitValueObject(val);\n }\n }\n}\n\nfunction ensureFrozenValue(realm, value, loc): void {\n // TODO: This should really check if it is recursively immutability.\n if (value instanceof ObjectValue && !TestIntegrityLevel(realm, value, \"frozen\")) {\n let diag = new CompilerDiagnostic(\n \"Unfrozen object leaked before end of global code\",\n loc || realm.currentLocation,\n \"PP0017\",\n \"RecoverableError\"\n );\n if (realm.handleError(diag) !== \"Recover\") throw new FatalError();\n }\n}\n\n// Ensure that a value is immutable. If it is not, set all its properties to abstract values\n// and all reachable bindings to abstract values.\nexport class HavocImplementation {\n value(realm: Realm, value: Value, loc: ?BabelNodeSourceLocation): void {\n if (realm.instantRender.enabled) {\n // TODO: For InstantRender...\n // - For declarative bindings, we do want proper materialization/leaking/havocing\n // - For object properties, we conceptually want materialization\n // (however, not via statements that mutate the objects,\n // but only as part of the initial object literals),\n // but actual no leaking or havocing as there should be a way to annotate/enforce\n // that external/abstract functions are pure with regards to heap objects\n return;\n }\n let objectsTrackedForHavoc = realm.createdObjectsTrackedForLeaks;\n if (objectsTrackedForHavoc === undefined) {\n // We're not tracking a pure function. That means that we would track\n // everything as havoced. We'll assume that any object argument\n // is invalid unless it's frozen.\n ensureFrozenValue(realm, value, loc);\n } else {\n // If we're tracking a pure function, we can assume that only newly\n // created objects and bindings, within it, are mutable. Any other\n // object can safely be assumed to be deeply immutable as far as this\n // pure function is concerned. However, any mutable object needs to\n // be tainted as possibly having changed to anything.\n let visitor = new ObjectValueHavocingVisitor(realm, objectsTrackedForHavoc);\n visitor.visitValue(value);\n }\n }\n}\n"],"file":"havoc.js"} |