Accurately type foreign functions, and variables.

src/typing-asm.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/typing-asm.h"
 
 #include <limits>
 
 #include "src/v8.h"
 
@@ skipping 18 matching lines @@
 
 
 #define RECURSE(call)               \
   do {                              \
     DCHECK(!HasStackOverflow());    \
     call;                           \
     if (HasStackOverflow()) return; \
     if (!valid_) return;            \
   } while (false)
 
-
 AsmTyper::AsmTyper(Isolate* isolate, Zone* zone, Script* script,
                    FunctionLiteral* root)
     : zone_(zone),
       isolate_(isolate),
       script_(script),
       root_(root),
       valid_(true),
       allow_simd_(false),
       property_info_(NULL),
       intish_(0),
       stdlib_types_(zone),
       stdlib_heap_types_(zone),
       stdlib_math_types_(zone),
 #define V(NAME, Name, name, lane_count, lane_type) \
   stdlib_simd_##name##_types_(zone),
       SIMD128_TYPES(V)
 #undef V
           global_variable_type_(HashMap::PointersMatch,
                                 ZoneHashMap::kDefaultHashMapCapacity,
                                 ZoneAllocationPolicy(zone)),
       local_variable_type_(HashMap::PointersMatch,
                            ZoneHashMap::kDefaultHashMapCapacity,
                            ZoneAllocationPolicy(zone)),
       in_function_(false),
       building_function_tables_(false),
+      visiting_exports_(false),
       cache_(TypeCache::Get()) {
   InitializeAstVisitor(isolate);
   InitializeStdlib();
 }
 
 
 bool AsmTyper::Validate() {
   VisitAsmModule(root_);
   return valid_ && !HasStackOverflow();
 }
@@ skipping 53 matching lines @@
     if (decl != NULL) {
       RECURSE(
           VisitWithExpectation(decl->fun(), Type::Any(zone()), "UNREACHABLE"));
       if (!computed_type_->IsFunction()) {
         FAIL(decl->fun(), "function literal expected to be a function");
       }
     }
   }
 
   // Validate exports.
+  visiting_exports_ = true;
   ReturnStatement* stmt = fun->body()->last()->AsReturnStatement();
   if (stmt == nullptr) {
     FAIL(fun->body()->last(), "last statement in module is not a return");
   }
   RECURSE(VisitWithExpectation(stmt->expression(), Type::Object(),
                                "expected object export"));
 }
 
 
 void AsmTyper::VisitVariableDeclaration(VariableDeclaration* decl) {
@@ skipping 334 matching lines @@
   FAIL(stmt, "try statement encountered");
 }
 
 
 void AsmTyper::VisitDebuggerStatement(DebuggerStatement* stmt) {
   FAIL(stmt, "debugger statement encountered");
 }
 
 
 void AsmTyper::VisitFunctionLiteral(FunctionLiteral* expr) {
-  Scope* scope = expr->scope();
-  DCHECK(scope->is_function_scope());
   if (in_function_) {
     FAIL(expr, "invalid nested function");
   }
+  Scope* scope = expr->scope();
+  DCHECK(scope->is_function_scope());
 
   if (!expr->bounds().upper->IsFunction()) {
     FAIL(expr, "invalid function literal");
   }
 
   Type::FunctionType* type = expr->bounds().upper->AsFunction();
   Type* save_return_type = return_type_;
   return_type_ = type->Result();
   in_function_ = true;
   local_variable_type_.Clear();
   RECURSE(VisitDeclarations(scope->declarations()));
   RECURSE(VisitStatements(expr->body()));
   in_function_ = false;
   return_type_ = save_return_type;
   IntersectResult(expr, type);
 }
 
 
 void AsmTyper::VisitNativeFunctionLiteral(NativeFunctionLiteral* expr) {
   FAIL(expr, "function info literal encountered");
 }
 
 
 void AsmTyper::VisitDoExpression(DoExpression* expr) {
   FAIL(expr, "do-expression encountered");
 }
 
 
 void AsmTyper::VisitConditional(Conditional* expr) {
+  if (!in_function_) {
+    FAIL(expr, "ternary operator inside module body");
+  }
   RECURSE(VisitWithExpectation(expr->condition(), Type::Number(),
                                "condition expected to be integer"));
   if (!computed_type_->Is(cache_.kAsmInt)) {
     FAIL(expr->condition(), "condition must be of type int");
   }
 
   RECURSE(VisitWithExpectation(
       expr->then_expression(), expected_type_,
       "conditional then branch type mismatch with enclosing expression"));
   Type* then_type = StorageType(computed_type_);
@@ skipping 11 matching lines @@
 
   if (!then_type->Is(else_type) || !else_type->Is(then_type)) {
     FAIL(expr, "then and else expressions in ? must have the same type");
   }
 
   IntersectResult(expr, then_type);
 }
 
 
 void AsmTyper::VisitVariableProxy(VariableProxy* expr) {
+  VisitVariableProxy(expr, false);
+}
+
+void AsmTyper::VisitVariableProxy(VariableProxy* expr, bool assignment) {
   Variable* var = expr->var();
   VariableInfo* info = GetVariableInfo(var, false);
+  if (!assignment && !in_function_ && !building_function_tables_ &&
+      !visiting_exports_) {
+    if (var->location() != VariableLocation::PARAMETER || var->index() >= 3) {
+      FAIL(expr, "illegal variable reference in module body");
+    }
+  }
   if (info == NULL || info->type == NULL) {
     if (var->mode() == TEMPORARY) {
       SetType(var, Type::Any(zone()));
       info = GetVariableInfo(var, false);
     } else {
       FAIL(expr, "unbound variable");
     }
   }
   if (property_info_ != NULL) {
     SetVariableInfo(var, property_info_);
@@ skipping 99 matching lines @@
   }
   if (expr->is_compound()) FAIL(expr, "compound assignment encountered");
   Type* type = expected_type_;
   RECURSE(VisitWithExpectation(
       expr->value(), type, "assignment value expected to match surrounding"));
   Type* target_type = StorageType(computed_type_);
   if (intish_ != 0) {
     FAIL(expr, "intish or floatish assignment");
   }
   if (expr->target()->IsVariableProxy()) {
-    RECURSE(VisitWithExpectation(expr->target(), target_type,
-                                 "assignment target expected to match value"));
+    expected_type_ = target_type;
+    VisitVariableProxy(expr->target()->AsVariableProxy(), true);
   } else if (expr->target()->IsProperty()) {
     Property* property = expr->target()->AsProperty();
     RECURSE(VisitWithExpectation(property->obj(), Type::Any(),
                                  "bad propety object"));
     if (!computed_type_->IsArray()) {
       FAIL(property->obj(), "array expected");
     }
     VisitHeapAccess(property, true, target_type);
   }
   IntersectResult(expr, target_type);
@@ skipping 215 matching lines @@
       SetResult(expr, expected_type_);
       return;
     }
   }
 
   FAIL(expr, "invalid property access");
 }
 
 
 void AsmTyper::VisitCall(Call* expr) {
+  Type* expected_type = expected_type_;
   RECURSE(VisitWithExpectation(expr->expression(), Type::Any(),
                                "callee expected to be any"));
   StandardMember standard_member = kNone;
   VariableProxy* proxy = expr->expression()->AsVariableProxy();
   if (proxy) {
     standard_member = VariableAsStandardMember(proxy->var());
   }
   if (!in_function_ && (proxy == NULL || standard_member != kMathFround)) {
     FAIL(expr, "calls forbidden outside function bodies");
   }
@@ skipping 42 matching lines @@
     }
     intish_ = 0;
     IntersectResult(expr, result_type);
   } else if (computed_type_->Is(Type::Any())) {
     // For foreign calls.
     ZoneList<Expression*>* args = expr->arguments();
     for (int i = 0; i < args->length(); ++i) {
       Expression* arg = args->at(i);
       RECURSE(VisitWithExpectation(arg, Type::Any(),
                                    "foreign call argument expected to be any"));
+      // Checking for asm extern types explicitly, as the type system
+      // doesn't correctly check their inheritance relationship.
+      if (!computed_type_->Is(cache_.kAsmSigned) &&
+          !computed_type_->Is(cache_.kAsmFixnum) &&
+          !computed_type_->Is(cache_.kAsmDouble)) {
+        FAIL(arg,
+             "foreign call argument expected to be int, double, or fixnum");
+      }
     }
     intish_ = kMaxUncombinedAdditiveSteps;
-    IntersectResult(expr, Type::Number());
+    IntersectResult(expr, expected_type);
   } else {
     FAIL(expr, "invalid callee");
   }
 }
 
 
 void AsmTyper::VisitCallNew(CallNew* expr) {
   if (in_function_) {
     FAIL(expr, "new not allowed in module function");
   }
@@ skipping 17 matching lines @@
   FAIL(expr, "ill-typed new operator");
 }
 
 
 void AsmTyper::VisitCallRuntime(CallRuntime* expr) {
   // Allow runtime calls for now.
 }
 
 
 void AsmTyper::VisitUnaryOperation(UnaryOperation* expr) {
+  if (!in_function_) {
+    FAIL(expr, "unary operator inside module body");
+  }
   switch (expr->op()) {
     case Token::NOT:  // Used to encode != and !==
       RECURSE(VisitWithExpectation(expr->expression(), cache_.kAsmInt,
                                    "operand expected to be integer"));
       IntersectResult(expr, cache_.kAsmSigned);
       return;
     case Token::DELETE:
       FAIL(expr, "delete operator encountered");
     case Token::VOID:
       FAIL(expr, "void operator encountered");
     case Token::TYPEOF:
       FAIL(expr, "typeof operator encountered");
     default:
       UNREACHABLE();
   }
 }
 
 
 void AsmTyper::VisitCountOperation(CountOperation* expr) {
   FAIL(expr, "increment or decrement operator encountered");
 }
 
 
 void AsmTyper::VisitIntegerBitwiseOperator(BinaryOperation* expr,
                                            Type* left_expected,
                                            Type* right_expected,
                                            Type* result_type, bool conversion) {
-  RECURSE(VisitWithExpectation(expr->left(), Type::Number(),
+  RECURSE(VisitWithExpectation(expr->left(), Type::Number(zone()),
                                "left bitwise operand expected to be a number"));
   int left_intish = intish_;
   Type* left_type = computed_type_;
   if (!left_type->Is(left_expected)) {
     FAIL(expr->left(), "left bitwise operand expected to be an integer");
   }
   if (left_intish > kMaxUncombinedAdditiveSteps) {
     FAIL(expr->left(), "too many consecutive additive ops");
   }
 
@@ skipping 20 matching lines @@
   if (!conversion) {
     if (!left_type->Is(right_type) || !right_type->Is(left_type)) {
       FAIL(expr, "ill-typed bitwise operation");
     }
   }
   IntersectResult(expr, result_type);
 }
 
 
 void AsmTyper::VisitBinaryOperation(BinaryOperation* expr) {
+  if (!in_function_) {
+    if (expr->op() != Token::BIT_OR && expr->op() != Token::MUL) {
+      FAIL(expr, "illegal binary operator inside module body");
+    }
+    if (!(expr->left()->IsProperty() || expr->left()->IsVariableProxy()) ||
+        !expr->right()->IsLiteral()) {
+      FAIL(expr, "illegal computation inside module body");
+    }
+  }
   switch (expr->op()) {
     case Token::COMMA: {
       RECURSE(VisitWithExpectation(expr->left(), Type::Any(),
                                    "left comma operand expected to be any"));
       RECURSE(VisitWithExpectation(expr->right(), Type::Any(),
                                    "right comma operand expected to be any"));
       IntersectResult(expr, computed_type_);
       return;
     }
     case Token::OR:
     case Token::AND:
       FAIL(expr, "illegal logical operator");
     case Token::BIT_OR: {
       // BIT_OR allows Any since it is used as a type coercion.
       VisitIntegerBitwiseOperator(expr, Type::Any(), cache_.kAsmInt,
                                   cache_.kAsmSigned, true);
+      if (expr->left()->IsCall() && expr->op() == Token::BIT_OR) {
+        IntersectResult(expr->left(), cache_.kAsmSigned);
+      }
       return;
     }
     case Token::BIT_XOR: {
       // Handle booleans specially to handle de-sugared !
       Literal* left = expr->left()->AsLiteral();
       if (left && left->value()->IsBoolean()) {
         if (left->ToBooleanIsTrue()) {
           left->set_bounds(Bounds(cache_.kSingletonOne));
           RECURSE(VisitWithExpectation(expr->right(), cache_.kAsmInt,
                                        "not operator expects an integer"));
@@ skipping 66 matching lines @@
             if (intish_ > kMaxUncombinedMultiplicativeSteps) {
               FAIL(expr, "too many consecutive multiplicative ops");
             }
           }
           IntersectResult(expr, cache_.kAsmInt);
           return;
         }
       } else if (expr->op() == Token::MUL && expr->right()->IsLiteral() &&
                  right_type->Is(cache_.kAsmDouble)) {
         // For unary +, expressed as x * 1.0
+        if (expr->left()->IsCall() && expr->op() == Token::MUL) {
+          IntersectResult(expr->left(), cache_.kAsmDouble);
+        }
         IntersectResult(expr, cache_.kAsmDouble);
         return;
       } else if (type->Is(cache_.kAsmFloat) && expr->op() != Token::MOD) {
         if (left_intish != 0 || right_intish != 0) {
           FAIL(expr, "float operation before required fround");
         }
         IntersectResult(expr, cache_.kAsmFloat);
         intish_ = 1;
         return;
       } else if (type->Is(cache_.kAsmDouble)) {
         IntersectResult(expr, cache_.kAsmDouble);
         return;
       } else {
         FAIL(expr, "ill-typed arithmetic operation");
       }
     }
     default:
       UNREACHABLE();
   }
 }
 
 
 void AsmTyper::VisitCompareOperation(CompareOperation* expr) {
+  if (!in_function_) {
+    FAIL(expr, "comparison inside module body");
+  }
   Token::Value op = expr->op();
   if (op != Token::EQ && op != Token::NE && op != Token::LT &&
       op != Token::LTE && op != Token::GT && op != Token::GTE) {
     FAIL(expr, "illegal comparison operator");
   }
 
   RECURSE(
       VisitWithExpectation(expr->left(), Type::Number(),
                            "left comparison operand expected to be number"));
   Type* left_type = computed_type_;
@@ skipping 266 matching lines @@
 
 
 void AsmTyper::VisitRewritableAssignmentExpression(
     RewritableAssignmentExpression* expr) {
   RECURSE(Visit(expr->expression()));
 }
 
 
 }  // namespace internal
 }  // namespace v8