qv4object.cpp

Go to the documentation of this file.

// Copyright (C) 2016 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
// Qt-Security score:significant
 
#include "qv4object_p.h"
 
#include <private/qv4argumentsobject_p.h>
#include <private/qv4identifiertable_p.h>
#include <private/qv4jscall_p.h>
#include <private/qv4lookup_p.h>
#include <private/qv4memberdata_p.h>
#include <private/qv4mm_p.h>
#include <private/qv4proxy_p.h>
#include <private/qv4scopedvalue_p.h>
#include <private/qv4stackframe_p.h>
#include <private/qv4stringobject_p.h>
#include <private/qv4symbol_p.h>
 
#include <QtCore/qloggingcategory.h>
 
#include <stdint.h>
 
using namespace QV4;
using namespace Qt::Literals::StringLiterals;
 
Q_STATIC_LOGGING_CATEGORY(lcJavaScriptGlobals, "qt.qml.js.globals")
 
DEFINE_OBJECT_VTABLE(Object);
 
void Object::setInternalClass(Heap::InternalClass *ic)
{
    Q_ASSERT(ic && ic->vtable);
    Heap::Object *p = d();
 
    if (ic->numRedundantTransitions < p->internalClass.get()->numRedundantTransitions) {
        // IC was rebuilt. The indices are different now. We need to move everything.
 
        Scope scope(engine());
 
        // We allocate before setting the new IC. Protect it from GC.
        Scoped<InternalClass> newIC(scope, ic);
 
        // Pick the members of the old IC that are still valid in the new IC.
        // Order them by index in memberData (or inline data).
        Scoped<MemberData> newMembers(scope, MemberData::allocate(scope.engine, ic->size));
        for (uint i = 0; i < ic->size; ++i) {
            // Note that some members might have been deleted. The key may be invalid.
            const PropertyKey key = ic->nameMap.at(i);
            // fromReturnedValue is safe, we directly write it through the WriteBarrier
            newMembers->set(scope.engine, i,
                            QV4::Value::fromReturnedValue(key.isValid() ? get(key) : Encode::undefined()));
        }
 
        p->internalClass.set(scope.engine, ic);
        const uint nInline = p->vtable()->nInlineProperties;
 
        if (ic->size > nInline)
            p->memberData.set(scope.engine, MemberData::allocate(ic->engine, ic->size - nInline));
        else
            p->memberData.set(scope.engine, nullptr);
 
        const auto &memberValues = newMembers->d()->values;
        for (uint i = 0; i < ic->size; ++i)
            setProperty(i, memberValues[i]);
    } else {
        // The old indices are still the same. No need to move any values.
        // We may need to re-allocate, though.
 
        p->internalClass.set(ic->engine, ic);
        const uint nInline = p->vtable()->nInlineProperties;
        if (ic->size > nInline) {
            const uint requiredSize = ic->size - nInline;
            if ((p->memberData ? p->memberData->values.size : 0) < requiredSize) {
                p->memberData.set(ic->engine, MemberData::allocate(
                                      ic->engine, requiredSize, p->memberData));
            }
        }
    }
 
    // Before the engine is done initializing, we cannot have any lookups.
    // Therefore, there is no point in updating the proto IDs.
    if (ic->engine->isInitialized && ic->isUsedAsProto())
        ic->updateProtoUsage(p);
 
}
 
void Object::getProperty(const InternalClassEntry &entry, Property *p) const
{
    p->value = *propertyData(entry.index);
    if (entry.attributes.isAccessor())
        p->set = *propertyData(entry.setterIndex);
}
 
void Object::setProperty(const InternalClassEntry &entry, const Property *p)
{
    setProperty(entry.index, p->value);
    if (entry.attributes.isAccessor())
        setProperty(entry.setterIndex, p->set);
}
 
void Heap::Object::setUsedAsProto()
{
    internalClass.set(internalClass->engine, internalClass->asProtoClass());
}
 
ReturnedValue Object::getValueAccessor(const Value *thisObject, const Value &v, PropertyAttributes attrs)
{
    if (!attrs.isAccessor())
        return v.asReturnedValue();
    const QV4::FunctionObject *f = v.as<FunctionObject>();
    if (!f)
        return Encode::undefined();
 
    Scope scope(f->engine());
    JSCallArguments jsCallData(scope);
    if (thisObject)
        *jsCallData.thisObject = *thisObject;
    return checkedResult(scope.engine, f->call(jsCallData));
}
 
bool Object::putValue(uint memberIndex, PropertyAttributes attrs, const Value &value)
{
    Heap::InternalClass *ic = internalClass();
    if (ic->engine->hasException)
        return false;
 
    if (attrs.isAccessor()) {
        const FunctionObject *set = propertyData(memberIndex)->as<FunctionObject>();
        if (set) {
            Scope scope(ic->engine);
            ScopedFunctionObject setter(scope, set);
            JSCallArguments jsCallData(scope, 1);
            jsCallData.args[0] = value;
            *jsCallData.thisObject = this;
            setter->call(jsCallData);
            return !ic->engine->hasException;
        }
        return false;
    }
 
    if (!attrs.isWritable())
        return false;
 
    setProperty(memberIndex, value);
    return true;
}
 
void Object::defineDefaultProperty(const QString &name, const Value &value, PropertyAttributes attributes)
{
    ExecutionEngine *e = engine();
    Scope scope(e);
    ScopedString s(scope, e->newIdentifier(name));
    defineDefaultProperty(s, value, attributes);
}
 
void Object::defineDefaultProperty(const QString &name, VTable::Call code,
                                   int argumentCount, PropertyAttributes attributes)
{
    ExecutionEngine *e = engine();
    Scope scope(e);
    ScopedString s(scope, e->newIdentifier(name));
    ScopedFunctionObject function(scope, FunctionObject::createBuiltinFunction(e, s, code, argumentCount));
    defineDefaultProperty(s, function, attributes);
}
 
void Object::defineDefaultProperty(StringOrSymbol *nameOrSymbol, VTable::Call code,
                                   int argumentCount, PropertyAttributes attributes)
{
    ExecutionEngine *e = engine();
    Scope scope(e);
    ScopedFunctionObject function(scope, FunctionObject::createBuiltinFunction(e, nameOrSymbol, code, argumentCount));
    defineDefaultProperty(nameOrSymbol, function, attributes);
}
 
void Object::defineAccessorProperty(const QString &name, VTable::Call getter, VTable::Call setter)
{
    ExecutionEngine *e = engine();
    Scope scope(e);
    ScopedString s(scope, e->newIdentifier(name));
    defineAccessorProperty(s, getter, setter);
}
 
void Object::defineAccessorProperty(StringOrSymbol *name, VTable::Call getter, VTable::Call setter)
{
    ExecutionEngine *v4 = engine();
    QV4::Scope scope(v4);
    ScopedProperty p(scope);
    QString n = name->toQString();
    if (!n.isEmpty() && n.at(0) == '@'_L1)
        n = '['_L1 + QStringView{n}.mid(1) + ']'_L1;
    if (getter) {
        ScopedString getName(scope, v4->newString("get "_L1 + n));
        p->setGetter(ScopedFunctionObject(scope, FunctionObject::createBuiltinFunction(v4, getName, getter, 0)));
    } else {
        p->setGetter(nullptr);
    }
    if (setter) {
        ScopedString setName(scope, v4->newString("set "_L1 + n));
        p->setSetter(ScopedFunctionObject(scope, FunctionObject::createBuiltinFunction(v4, setName, setter, 0)));
    } else {
        p->setSetter(nullptr);
    }
    insertMember(name, p, QV4::Attr_Accessor|QV4::Attr_NotEnumerable);
}
 
 
 
void Object::defineReadonlyProperty(const QString &name, const Value &value)
{
    QV4::ExecutionEngine *e = engine();
    Scope scope(e);
    ScopedString s(scope, e->newIdentifier(name));
    defineReadonlyProperty(s, value);
}
 
void Object::defineReadonlyProperty(String *name, const Value &value)
{
    insertMember(name, value, Attr_ReadOnly);
}
 
void Object::defineReadonlyConfigurableProperty(const QString &name, const Value &value)
{
    QV4::ExecutionEngine *e = engine();
    Scope scope(e);
    ScopedString s(scope, e->newIdentifier(name));
    defineReadonlyConfigurableProperty(s, value);
}
 
void Object::defineReadonlyConfigurableProperty(StringOrSymbol *name, const Value &value)
{
    insertMember(name, value, Attr_ReadOnly_ButConfigurable);
}
 
void Object::addSymbolSpecies()
{
    Scope scope(engine());
    ScopedProperty p(scope);
    p->setGetter(scope.engine->getSymbolSpecies());
    p->setSetter(nullptr);
    insertMember(scope.engine->symbol_species(), p, QV4::Attr_Accessor|QV4::Attr_NotWritable|QV4::Attr_NotEnumerable);
}
 
void Heap::Object::markObjects(Heap::Base *b, MarkStack *stack)
{
    Base::markObjects(b, stack);
    Object *o = static_cast<Object *>(b);
    if (o->memberData)
        o->memberData->mark(stack);
    if (o->arrayData)
        o->arrayData->mark(stack);
    uint nInline = o->vtable()->nInlineProperties;
    Value *v = reinterpret_cast<Value *>(o) + o->vtable()->inlinePropertyOffset;
    const Value *end = v + nInline;
    while (v < end) {
        v->mark(stack);
        ++v;
    }
}
 
void Object::insertMember(StringOrSymbol *s, const Property *p, PropertyAttributes attributes)
{
    InternalClassEntry idx;
    PropertyKey key = s->toPropertyKey();
    Heap::InternalClass::addMember(this, key, attributes, &idx);
 
    setProperty(idx.index, p->value);
    if (attributes.isAccessor())
        setProperty(idx.setterIndex, p->set);
}
 
void Object::setPrototypeUnchecked(const Object *p)
{
    setInternalClass(internalClass()->changePrototype(p ? p->d() : nullptr));
}
 
// Section 8.12.2
PropertyIndex Object::getValueOrSetter(PropertyKey id, PropertyAttributes *attrs)
{
    if (id.isArrayIndex()) {
        uint index = id.asArrayIndex();
        Heap::Object *o = d();
        while (o) {
            if (o->arrayData) {
                uint idx = o->arrayData->mappedIndex(index);
                if (idx != UINT_MAX) {
                    *attrs = o->arrayData->attributes(index);
                    return { o->arrayData , o->arrayData->values.values + (attrs->isAccessor() ? idx + SetterOffset : idx) };
                }
            }
            if (o->vtable()->type == Type_StringObject) {
                if (index < static_cast<const Heap::StringObject *>(o)->length()) {
                    // this is an evil hack, but it works, as the method is only ever called from put,
                    // where we don't use the returned pointer there for non writable attributes
                    *attrs = (Attr_NotWritable|Attr_NotConfigurable);
                    return { reinterpret_cast<Heap::ArrayData *>(0x1), nullptr };
                }
            }
            o = o->prototype();
        }
    } else {
        Heap::Object *o = d();
        while (o) {
            auto idx = o->internalClass->findValueOrSetter(id);
            if (idx.isValid()) {
                *attrs = idx.attrs;
                return o->writablePropertyData(idx.index);
            }
 
            o = o->prototype();
        }
    }
    *attrs = Attr_Invalid;
    return { nullptr, nullptr };
}
 
ReturnedValue Object::virtualGet(const Managed *m, PropertyKey id, const Value *receiver, bool *hasProperty)
{
    return static_cast<const Object *>(m)->internalGet(id, receiver, hasProperty);
}
 
bool Object::virtualPut(Managed *m, PropertyKey id, const Value &value, Value *receiver)
{
    return static_cast<Object *>(m)->internalPut(id, value, receiver);
}
 
bool Object::virtualDeleteProperty(Managed *m, PropertyKey id)
{
    return static_cast<Object *>(m)->internalDeleteProperty(id);
}
 
PropertyKey ObjectOwnPropertyKeyIterator::next(const Object *o, Property *pd, PropertyAttributes *attrs)
{
    if (arrayIndex != UINT_MAX && o->arrayData()) {
        SparseArrayNode *arrayNode = nullptr;
        if (o->arrayType() == Heap::ArrayData::Sparse) {
            SparseArray *sparse = o->arrayData()->sparse;
            arrayNode = arrayIndex ? sparse->lowerBound(arrayIndex) : sparse->begin();
        }
 
        // sparse arrays
        if (arrayNode) {
            while (arrayNode != o->sparseEnd()) {
                uint k = arrayNode->key();
                uint pidx = arrayNode->value;
                Heap::SparseArrayData *sa = o->d()->arrayData.cast<Heap::SparseArrayData>();
                const Property *p = reinterpret_cast<const Property *>(sa->values.data() + pidx);
                arrayNode = arrayNode->nextNode();
                PropertyAttributes a = sa->attrs ? sa->attrs[pidx] : Attr_Data;
                arrayIndex = k + 1;
                if (pd)
                    pd->copy(p, a);
                if (attrs)
                    *attrs = a;
                return PropertyKey::fromArrayIndex(k);
            }
            arrayIndex = UINT_MAX;
        }
        // dense arrays
        while (arrayIndex < o->d()->arrayData->values.size) {
            Heap::SimpleArrayData *sa = o->d()->arrayData.cast<Heap::SimpleArrayData>();
            const Value &val = sa->data(arrayIndex);
            PropertyAttributes a = o->arrayData()->attributes(arrayIndex);
            int index = arrayIndex;
            ++arrayIndex;
            if (!val.isEmpty()) {
                if (pd)
                    pd->value = val;
                if (attrs)
                    *attrs = a;
                return PropertyKey::fromArrayIndex(index);
            }
        }
        arrayIndex = UINT_MAX;
    }
 
    while (true) {
        while (memberIndex < o->internalClass()->size) {
            PropertyKey n = o->internalClass()->nameMap.at(memberIndex);
            ++memberIndex;
            if (!n.isStringOrSymbol())
                // accessor properties have a dummy entry with n == 0
                continue;
            if (!iterateOverSymbols && n.isSymbol())
                continue;
            if (iterateOverSymbols && !n.isSymbol())
                continue;
 
            InternalClassEntry e = o->internalClass()->find(n);
            if (!e.isValid())
                continue;
            if (pd) {
                pd->value = *o->propertyData(e.index);
                if (e.attributes.isAccessor())
                    pd->set = *o->propertyData(e.setterIndex);
            }
            if (attrs)
                *attrs = e.attributes;
            return n;
        }
        if (iterateOverSymbols)
            break;
        iterateOverSymbols = true;
        memberIndex = 0;
    }
 
    return PropertyKey::invalid();
}
 
OwnPropertyKeyIterator *Object::virtualOwnPropertyKeys(const Object *o, Value *target)
{
    *target = *o;
    return new ObjectOwnPropertyKeyIterator;
}
 
// Section 8.12.3
ReturnedValue Object::internalGet(PropertyKey id, const Value *receiver, bool *hasProperty) const
{
    Heap::Object *o = d();
 
    if (id.isArrayIndex()) {
        const uint index = id.asArrayIndex();
        Scope scope(this);
        PropertyAttributes attrs;
        ScopedProperty pd(scope);
        while (1) {
            if (o->arrayData && o->arrayData->getProperty(index, pd, &attrs)) {
                if (hasProperty)
                    *hasProperty = true;
                return Object::getValue(receiver, pd->value, attrs);
            }
            if (o->internalClass->vtable->type == Type_StringObject) {
                ScopedString str(scope, static_cast<Heap::StringObject *>(o)->getIndex(index));
                if (str) {
                    attrs = (Attr_NotWritable|Attr_NotConfigurable);
                    if (hasProperty)
                        *hasProperty = true;
                    return str.asReturnedValue();
                }
            }
            o = o->prototype();
            if (!o || o->internalClass->vtable->get != Object::virtualGet)
                break;
        }
    } else {
        while (1) {
            auto idx = o->internalClass->findValueOrGetter(id);
            if (idx.isValid()) {
                if (hasProperty)
                    *hasProperty = true;
                return Object::getValue(receiver, *o->propertyData(idx.index), idx.attrs);
            }
            o = o->prototype();
            if (!o || o->internalClass->vtable->get != Object::virtualGet)
                break;
        }
    }
 
    if (o) {
        const Value v = Value::fromHeapObject(o);
        const Object &obj = static_cast<const Object &>(v);
        return obj.get(id, receiver, hasProperty);
    }
 
    if (hasProperty)
        *hasProperty = false;
    return Encode::undefined();
}
 
// Section 8.12.5
bool Object::internalPut(PropertyKey id, const Value &value, Value *receiver)
{
    Scope scope(this);
    if (scope.hasException())
        return false;
 
    Object *r = receiver->objectValue();
    if (r && r->d() == d()) {
        // receiver and this object are the same
        if (d()->internalClass->vtable->getOwnProperty == Object::virtualGetOwnProperty) {
            // This object standard methods in the vtable, so we can take a shortcut
            // and avoid the calls to getOwnProperty and defineOwnProperty
 
            PropertyAttributes attrs;
            PropertyIndex propertyIndex{nullptr, nullptr};
 
            if (id.isArrayIndex()) {
                if (arrayData())
                    propertyIndex = arrayData()->getValueOrSetter(id.asArrayIndex(), &attrs);
            } else {
                auto member = internalClass()->findValueOrSetter(id);
                if (member.isValid()) {
                    attrs = member.attrs;
                    propertyIndex = d()->writablePropertyData(member.index);
                }
            }
 
            if (!propertyIndex.isNull() && !attrs.isAccessor()) {
                if (!attrs.isWritable())
                    return false;
                else if (isArrayObject() && id == scope.engine->id_length()->propertyKey()) {
                    bool ok;
                    uint l = value.asArrayLength(&ok);
                    if (!ok) {
                        scope.engine->throwRangeError(value);
                        return false;
                    }
                    ok = setArrayLength(l);
                    if (!ok)
                        return false;
                } else {
                    propertyIndex.set(scope.engine, value);
                }
                return true;
            }
        }
    }
 
    ScopedProperty p(scope);
    PropertyAttributes attrs;
    attrs = getOwnProperty(id, p);
    if (attrs == Attr_Invalid) {
        ScopedObject p(scope, getPrototypeOf());
        if (p)
            return p->put(id, value, receiver);
        attrs = Attr_Data;
    }
 
    if (attrs.isAccessor()) {
        ScopedFunctionObject setter(scope, p->setter());
        if (!setter)
            return false;
        JSCallArguments jsCallData(scope, 1);
        jsCallData.args[0] = value;
        *jsCallData.thisObject = *receiver;
        setter->call(jsCallData);
        return !scope.hasException();
    }
 
    // Data property
    if (!attrs.isWritable())
        return false;
    if (!r)
        return false;
    attrs = r->getOwnProperty(id, p);
 
    if (attrs != Attr_Invalid) {
        if (attrs.isAccessor() || !attrs.isWritable())
            return false;
    } else {
        if (!r->isExtensible())
            return false;
        attrs = Attr_Data;
    }
 
    if (r->internalClass()->vtable->defineOwnProperty == virtualDefineOwnProperty) {
        // standard object, we can avoid some more checks
        if (id.isArrayIndex()) {
            r->arraySet(id.asArrayIndex(), value);
        } else {
            ScopedStringOrSymbol s(scope, id.asStringOrSymbol());
            r->insertMember(s, value);
        }
        return true;
    }
 
    p->value = value;
    return r->defineOwnProperty(id, p, attrs);
}
 
// Section 8.12.7
bool Object::internalDeleteProperty(PropertyKey id)
{
    if (internalClass()->engine->hasException)
        return false;
 
    if (id.isArrayIndex()) {
        uint index = id.asArrayIndex();
        Scope scope(engine());
        if (scope.hasException())
            return false;
 
        Scoped<ArrayData> ad(scope, arrayData());
        if (!ad || ad->vtable()->del(this, index))
            return true;
 
        return false;
    }
 
    auto memberIdx = internalClass()->findValueOrGetter(id);
    if (memberIdx.isValid()) {
        if (memberIdx.attrs.isConfigurable()) {
            Heap::InternalClass::removeMember(this, id);
            return true;
        }
        return false;
    }
 
    return true;
}
 
bool Object::internalDefineOwnProperty(ExecutionEngine *engine, uint index, const InternalClassEntry *memberEntry, const Property *p, PropertyAttributes attrs)
{
    // clause 5
    if (attrs.isEmpty())
        return true;
 
    Scope scope(engine);
    ScopedProperty current(scope);
    PropertyAttributes cattrs;
    if (memberEntry) {
        getProperty(*memberEntry, current);
        cattrs = memberEntry->attributes;
    } else if (arrayData()) {
        arrayData()->getProperty(index, current, &cattrs);
        cattrs = arrayData()->attributes(index);
    }
 
    // clause 6
    if (p->isSubset(attrs, current, cattrs))
        return true;
 
    // clause 7
    if (!cattrs.isConfigurable()) {
        if (attrs.isConfigurable())
            return false;
        if (attrs.hasEnumerable() && attrs.isEnumerable() != cattrs.isEnumerable())
            return false;
    }
 
    // clause 8
    if (attrs.isGeneric() || current->value.isEmpty())
        goto accept;
 
    // clause 9
    if (cattrs.isData() != attrs.isData()) {
        // 9a
        if (!cattrs.isConfigurable())
            return false;
        if (cattrs.isData()) {
            // 9b
            cattrs.setType(PropertyAttributes::Accessor);
            cattrs.clearWritable();
            if (!memberEntry) {
                // need to convert the array and the slot
                initSparseArray();
                Q_ASSERT(arrayData());
                setArrayAttributes(index, cattrs);
            }
            current->setGetter(nullptr);
            current->setSetter(nullptr);
        } else {
            // 9c
            cattrs.setType(PropertyAttributes::Data);
            cattrs.setWritable(false);
            if (!memberEntry) {
                // need to convert the array and the slot
                setArrayAttributes(index, cattrs);
            }
            current->value = Value::undefinedValue();
        }
    } else if (cattrs.isData() && attrs.isData()) { // clause 10
        if (!cattrs.isConfigurable() && !cattrs.isWritable()) {
            if (attrs.isWritable() || !current->value.sameValue(p->value))
                return false;
        }
    } else { // clause 10
        Q_ASSERT(cattrs.isAccessor() && attrs.isAccessor());
        if (!cattrs.isConfigurable()) {
            if (!p->value.isEmpty() && current->value.rawValue() != p->value.rawValue())
                return false;
            if (!p->set.isEmpty() && current->set.rawValue() != p->set.rawValue())
                return false;
        }
    }
 
  accept:
 
    current->merge(cattrs, p, attrs);
    if (memberEntry) {
        PropertyKey key = internalClass()->nameMap.at(memberEntry->index);
        InternalClassEntry e;
        Heap::InternalClass::changeMember(this, key, cattrs, &e);
        setProperty(e, current);
    } else {
        setArrayAttributes(index, cattrs);
        arrayData()->setProperty(scope.engine, index, current);
    }
    return true;
}
 
void Object::copyArrayData(Object *other)
{
    Q_ASSERT(isArrayObject());
    Scope scope(engine());
 
    if (other->protoHasArray() || ArgumentsObject::isNonStrictArgumentsObject(other) ||
        (other->arrayType() == Heap::ArrayData::Sparse && other->arrayData()->attrs)) {
        uint len = other->getLength();
        Q_ASSERT(len);
 
        ScopedValue v(scope);
        for (uint i = 0; i < len; ++i) {
            arraySet(i, (v = other->get(i)));
        }
    } else if (!other->arrayData()) {
        ;
    } else {
        Q_ASSERT(!arrayData() && other->arrayData());
        ArrayData::realloc(this, static_cast<ArrayData::Type>(other->d()->arrayData->type),
                           other->d()->arrayData->values.alloc, false);
        if (other->arrayType() == Heap::ArrayData::Sparse) {
            Heap::ArrayData *od = other->d()->arrayData;
            Heap::ArrayData *dd = d()->arrayData;
            dd->sparse = new SparseArray(*od->sparse);
        } else {
            Heap::ArrayData *dd = d()->arrayData;
            dd->values.size = other->d()->arrayData->values.size;
            dd->offset = other->d()->arrayData->offset;
        }
        // ### need a write barrier
        memcpy(d()->arrayData->values.values, other->d()->arrayData->values.values, other->d()->arrayData->values.alloc*sizeof(Value));
    }
    setArrayLengthUnchecked(other->getLength());
}
 
qint64 Object::virtualGetLength(const Managed *m)
{
    Scope scope(static_cast<const Object *>(m)->engine());
    ScopedValue v(scope, static_cast<Object *>(const_cast<Managed *>(m))->get(scope.engine->id_length()));
    return v->toLength();
}
 
// 'var' is 'V' in 15.3.5.3.
ReturnedValue Object::virtualInstanceOf(const Object *typeObject, const Value &var)
{
    QV4::ExecutionEngine *engine = typeObject->internalClass()->engine;
 
    // 15.3.5.3, Assume F is a Function object.
    const FunctionObject *function = typeObject->as<FunctionObject>();
    if (!function)
        return engine->throwTypeError();
 
    return checkedInstanceOf(engine, function, var);
}
 
ReturnedValue Object::virtualResolveLookupGetter(const Object *object, ExecutionEngine *engine, Lookup *lookup)
{
    // Otherwise we cannot trust the protoIds
    Q_ASSERT(engine->isInitialized);
 
    Heap::Object *obj = object->d();
    PropertyKey name = engine->identifierTable->asPropertyKey(engine->currentStackFrame->v4Function->compilationUnit->runtimeStrings[lookup->nameIndex]);
    if (object->as<QV4::ProxyObject>()) {
        // proxies invalidate assumptions that we normally maek in lookups
        // so we always need to use the fallback path
        lookup->call = Lookup::Call::GetterQObjectPropertyFallback;
        return lookup->getter(engine, *object);
    }
    if (name.isArrayIndex()) {
        lookup->indexedLookup.index = name.asArrayIndex();
        lookup->call = Lookup::Call::GetterIndexed;
        return lookup->getter(engine, *object);
    }
 
    auto index = obj->internalClass->findValueOrGetter(name);
    if (index.isValid()) {
        PropertyAttributes attrs = index.attrs;
        uint nInline = obj->vtable()->nInlineProperties;
        if (attrs.isData()) {
            if (index.index < obj->vtable()->nInlineProperties) {
                index.index += obj->vtable()->inlinePropertyOffset;
                lookup->call = Lookup::Call::Getter0Inline;
            } else {
                index.index -= nInline;
                lookup->call = Lookup::Call::Getter0MemberData;
            }
        } else {
            lookup->call = Lookup::Call::GetterAccessor;
        }
        lookup->objectLookup.ic.set(engine, obj->internalClass.get());
        lookup->objectLookup.offset = index.index;
        return lookup->getter(engine, *object);
    }
 
    lookup->protoLookup.protoId = obj->internalClass->protoId;
    lookup->resolveProtoGetter(name, obj->prototype());
    return lookup->getter(engine, *object);
}
 
bool Object::virtualResolveLookupSetter(Object *object, ExecutionEngine *engine, Lookup *lookup, const Value &value)
{
    // Otherwise we cannot trust the protoIds
    Q_ASSERT(engine->isInitialized);
 
    Scope scope(engine);
    ScopedString name(scope, scope.engine->currentStackFrame->v4Function->compilationUnit->runtimeStrings[lookup->nameIndex]);
 
    Heap::InternalClass *c = object->internalClass();
    PropertyKey key = name->toPropertyKey();
    auto idx = c->findValueOrSetter(key);
    if (idx.isValid()) {
        if (object->isArrayObject() && idx.index == Heap::ArrayObject::LengthPropertyIndex) {
            Q_ASSERT(!idx.attrs.isAccessor());
            lookup->call = Lookup::Call::SetterArrayLength;
            return lookup->setter(engine, *object, value);
        } else if (idx.attrs.isData() && idx.attrs.isWritable()) {
            lookup->objectLookup.ic.set(engine, object->internalClass());
            lookup->objectLookup.index = idx.index;
            const auto nInline = object->d()->vtable()->nInlineProperties;
            if (idx.index < nInline) {
                lookup->call = Lookup::Call::Setter0Inline;
                lookup->objectLookup.offset = idx.index + object->d()->vtable()->inlinePropertyOffset;
            } else {
                lookup->call = Lookup::Call::Setter0MemberData;
                lookup->objectLookup.offset = idx.index - nInline;
            }
            return lookup->setter(engine, *object, value);
        } else {
            // ### handle setter
            lookup->call = Lookup::Call::SetterQObjectPropertyFallback;
        }
        return lookup->setter(engine, *object, value);
    }
 
    lookup->insertionLookup.protoId = c->protoId;
    if (!object->put(key, value)) {
        lookup->call = Lookup::Call::SetterQObjectPropertyFallback;
        return false;
    }
 
    if (object->internalClass() == c) {
        // ### setter in the prototype, should handle this
        lookup->call = Lookup::Call::SetterQObjectPropertyFallback;
        return true;
    }
    idx = object->internalClass()->findValueOrSetter(key);
    if (!idx.isValid() || idx.attrs.isAccessor()) { // ### can this even happen?
        lookup->call = Lookup::Call::SetterQObjectPropertyFallback;
        return false;
    }
    lookup->insertionLookup.newClass.set(engine, object->internalClass());
    lookup->insertionLookup.offset = idx.index;
    lookup->call = Lookup::Call::SetterInsert;
    return true;
}
 
/*!
 * \internal
 *
 * This method is modeled after \l{QMetaObject::metacall}. It takes a JavaScript
 * \a object and performs \a call on it, using \a index as identifier for the
 * property/method/etc to be used and \a a as arguments. Like
 * \l{QMetaObject::metacall} this method is overly generic in order to reduce the
 * API surface. On a plain Object it does nothing and returns 0. Specific
 * objects can override it and do some meaningful work. If the metacall succeeds
 * they should return a non-0 value. Otherwise they should return 0.
 *
 * Most prominently, \l QMetaObject::ReadProperty and \l QMetaObject::WriteProperty
 * calls can be used to manipulate properties of QObjects and Q_GADGETs wrapped
 * by QV4::QObjectWrapper, QV4::QQmlTypeWrapper and QV4::QQmlValueTypeWrapper.
 * They can also be used to manipulate elements in QV4::Sequence.
 */
int Object::virtualMetacall(Object *object, QMetaObject::Call call, int index, void **a)
{
    Q_UNUSED(object);
    Q_UNUSED(call);
    Q_UNUSED(index);
    Q_UNUSED(a);
    return 0;
}
 
ReturnedValue Object::checkedInstanceOf(ExecutionEngine *engine, const FunctionObject *f, const Value &var)
{
    Scope scope(engine);
    if (f->isBoundFunction()) {
        ScopedValue v(scope, static_cast<const BoundFunction *>(f)->target());
        f = v->as<FunctionObject>();
    }
 
    // 15.3.5.3, 1: HasInstance can only be used on an object
    const Object *lhs = var.as<Object>();
    if (!lhs)
        return Encode(false);
 
    // 15.3.5.3, 2
    Value p = Value::fromReturnedValue(f->protoProperty());
    const Object *o = p.objectValue();
    if (!o) // 15.3.5.3, 3
        return f->engine()->throwTypeError();
 
    Heap::Object *v = lhs->d();
 
    // 15.3.5.3, 4
    while (v) {
        // 15.3.5.3, 4, a
        v = v->prototype();
 
        // 15.3.5.3, 4, b
        if (!v)
            break; // will return false
 
        // 15.3.5.3, 4, c
        else if (o->d() == v)
            return Encode(true);
    }
 
    return Encode(false);
}
 
bool Object::virtualHasProperty(const Managed *m, PropertyKey id)
{
    Scope scope(m->engine());
    ScopedObject o(scope, m);
    ScopedProperty p(scope);
 
    if (o->getOwnProperty(id, p) != Attr_Invalid)
        return true;
 
    o = o->getPrototypeOf();
    if (o)
        return o->hasProperty(id);
 
    return false;
}
 
PropertyAttributes Object::virtualGetOwnProperty(const Managed *m, PropertyKey id, Property *p)
{
    PropertyAttributes attrs;
    const Object *o = static_cast<const Object *>(m);
    if (id.isArrayIndex()) {
        uint index = id.asArrayIndex();
        if (o->arrayData()) {
            if (o->arrayData()->getProperty(index, p, &attrs))
                return attrs;
        }
    } else {
        Q_ASSERT(id.asStringOrSymbol());
 
        auto member = o->internalClass()->find(id);
        if (member.isValid()) {
            attrs = member.attributes;
            if (p) {
                p->value = *o->propertyData(member.index);
                if (attrs.isAccessor())
                    p->set = *o->propertyData(member.setterIndex);
            }
            return attrs;
        }
    }
 
    return Attr_Invalid;
}
 
bool Object::virtualDefineOwnProperty(Managed *m, PropertyKey id, const Property *p, PropertyAttributes attrs)
{
    Object *o = static_cast<Object *>(m);
    Scope scope(o);
 
    if (id.isArrayIndex()) {
        uint index = id.asArrayIndex();
 
        bool hasProperty = false;
 
        if (o->arrayData()) {
            hasProperty = o->arrayData()->mappedIndex(index) != UINT_MAX;
            if (!hasProperty && o->isStringObject())
                hasProperty = (index < static_cast<StringObject *>(o)->length());
        }
 
        if (!hasProperty) {
            if (!o->isExtensible())
                return false;
 
            ScopedProperty pp(scope);
            pp->copy(p, attrs);
            pp->fullyPopulated(&attrs);
            if (attrs == Attr_Data) {
                ScopedValue v(scope, pp->value);
                o->arraySet(index, v);
            } else {
                o->arraySet(index, pp, attrs);
            }
            return true;
        }
 
        return o->internalDefineOwnProperty(scope.engine, index, nullptr, p, attrs);
    }
 
    Scoped<InternalClass> ic(scope, o->internalClass());
    auto memberIndex = ic->d()->find(id);
 
    if (!memberIndex.isValid()) {
        if (!o->isExtensible())
            return false;
 
        // If the IC is locked, you're not allowed to shadow any unconfigurable properties.
        if (ic->d()->isLocked()) {
            while (Heap::Object *prototype = ic->d()->prototype) {
                ic = prototype->internalClass;
                const auto entry = ic->d()->find(id);
                if (entry.isValid()) {
                    if (entry.attributes.isConfigurable())
                        break;
                    qCWarning(lcJavaScriptGlobals).noquote()
                            << QStringLiteral("You cannot shadow the locked property "
                                              "'%1' in QML.").arg(id.toQString());
                    return false;
                }
            }
        }
 
        Scoped<StringOrSymbol> name(scope, id.asStringOrSymbol());
        ScopedProperty pd(scope);
        pd->copy(p, attrs);
        pd->fullyPopulated(&attrs);
        o->insertMember(name, pd, attrs);
        return true;
    }
 
    return o->internalDefineOwnProperty(scope.engine, UINT_MAX, &memberIndex, p, attrs);
}
 
bool Object::virtualIsExtensible(const Managed *m)
{
    return m->d()->internalClass->isExtensible();
}
 
bool Object::virtualPreventExtensions(Managed *m)
{
    Q_ASSERT(m->isObject());
    Object *o = static_cast<Object *>(m);
    o->setInternalClass(o->internalClass()->nonExtensible());
    return true;
}
 
Heap::Object *Object::virtualGetPrototypeOf(const Managed *m)
{
    return m->internalClass()->prototype;
}
 
bool Object::virtualSetPrototypeOf(Managed *m, const Object *proto)
{
    Q_ASSERT(m->isObject());
    Object *o = static_cast<Object *>(m);
    Heap::InternalClass *ic = o->internalClass();
    Heap::Object *current = ic->prototype;
    Heap::Object *protod = proto ? proto->d() : nullptr;
    if (current == protod)
        return true;
    if (!ic->isExtensible() || ic->isLocked())
        return false;
    Heap::Object *p = protod;
    while (p) {
        if (p == o->d())
            return false;
        if (p->vtable()->getPrototypeOf != Object::staticVTable()->getPrototypeOf)
            break;
        p = p->prototype();
    }
    o->setInternalClass(ic->changePrototype(protod));
    return true;
}
 
bool Object::setArrayLength(uint newLen)
{
    Q_ASSERT(isArrayObject());
    if (!internalClass()->propertyData[Heap::ArrayObject::LengthPropertyIndex].isWritable())
        return false;
    uint oldLen = getLength();
    bool ok = true;
    if (newLen < oldLen) {
        if (arrayData()) {
            uint l = arrayData()->vtable()->truncate(this, newLen);
            if (l != newLen)
                ok = false;
            newLen = l;
        }
    } else {
        if (newLen >= 0x100000)
            initSparseArray();
        else
            ArrayData::realloc(this, arrayType(), newLen, false);
    }
    setArrayLengthUnchecked(newLen);
    return ok;
}
 
void Object::initSparseArray()
{
    if (arrayType() == Heap::ArrayData::Sparse)
        return;
 
    ArrayData::realloc(this, Heap::ArrayData::Sparse, 0, false);
}
 
bool Object::isConcatSpreadable() const
{
    Scope scope(this);
    ScopedValue spreadable(scope, get(scope.engine->symbol_isConcatSpreadable()));
    if (!spreadable->isUndefined())
        return spreadable->toBoolean();
    return isArray();
}
 
bool Object::isArray() const
{
    if (isArrayObject())
        return true;
    if (vtable() == ProxyObject::staticVTable()) {
        const ProxyObject *p = static_cast<const ProxyObject *>(this);
        Scope scope(this);
        if (!p->d()->handler) {
            scope.engine->throwTypeError();
            return false;
        }
        ScopedObject o(scope, p->d()->target);
        return o->isArray();
    }
    return false;
}
 
const FunctionObject *Object::speciesConstructor(Scope &scope, const FunctionObject *defaultConstructor) const
{
    ScopedValue C(scope, get(scope.engine->id_constructor()));
    if (C->isUndefined())
        return defaultConstructor;
    const Object *c = C->objectValue();
    if (!c) {
        scope.engine->throwTypeError();
        return nullptr;
    }
    ScopedValue S(scope, c->get(scope.engine->symbol_species()));
    if (S->isNullOrUndefined())
        return defaultConstructor;
    const FunctionObject *f = S->as<FunctionObject>();
    if (!f || !f->isConstructor()) {
        scope.engine->throwTypeError();
        return nullptr;
    }
    Q_ASSERT(f->isFunctionObject());
    return static_cast<const FunctionObject *>(f);
}
 
bool Object::setProtoFromNewTarget(const Value *newTarget)
{
    if (!newTarget || newTarget->isUndefined())
        return false;
 
    Q_ASSERT(newTarget->isFunctionObject());
    Scope scope(this);
    ScopedObject proto(scope, static_cast<const FunctionObject *>(newTarget)->protoProperty());
    if (proto) {
        setPrototypeOf(proto);
        return true;
    }
    return false;
}
 
 
DEFINE_OBJECT_VTABLE(ArrayObject);
 
void Heap::ArrayObject::init(const QStringList &list)
{
    Object::init();
    commonInit();
    Scope scope(internalClass->engine);
    ScopedObject a(scope, this);
 
    // Converts a QStringList to JS.
    // The result is a new Array object with length equal to the length
    // of the QStringList, and the elements being the QStringList's
    // elements converted to JS Strings.
    int len = list.size();
    a->arrayReserve(len);
    ScopedValue v(scope);
    for (int ii = 0; ii < len; ++ii)
        a->arrayPut(ii, (v = scope.engine->newString(list.at(ii))));
    a->setArrayLengthUnchecked(len);
}
 
qint64 ArrayObject::virtualGetLength(const Managed *m)
{
    const ArrayObject *a = static_cast<const ArrayObject *>(m);
    return a->propertyData(Heap::ArrayObject::LengthPropertyIndex)->toLength();
}
 
QStringList ArrayObject::toQStringList() const
{
    QStringList result;
 
    QV4::ExecutionEngine *engine = internalClass()->engine;
    Scope scope(engine);
    ScopedValue v(scope);
 
    uint length = getLength();
    result.reserve(length);
    for (uint i = 0; i < length; ++i) {
        v = const_cast<ArrayObject *>(this)->get(i);
        result.append(v->toQStringNoThrow());
    }
    return result;
}
 
bool ArrayObject::virtualDefineOwnProperty(Managed *m, PropertyKey id, const Property *p, PropertyAttributes attrs)
{
    Q_ASSERT(m->isArrayObject());
    ArrayObject *a = static_cast<ArrayObject *>(m);
 
    if (id.isArrayIndex()) {
        uint index = id.asArrayIndex();
        uint len = a->getLength();
        if (index >= len && !a->internalClass()->propertyData[Heap::ArrayObject::LengthPropertyIndex].isWritable())
            return false;
 
        bool succeeded = Object::virtualDefineOwnProperty(m, id, p, attrs);
        if (!succeeded)
            return false;
 
        if (index >= len)
            a->setArrayLengthUnchecked(index + 1);
 
        return true;
    }
 
    ExecutionEngine *engine = m->engine();
    if (id == engine->id_length()->propertyKey()) {
        Scope scope(engine);
        Q_ASSERT(a->internalClass()->verifyIndex(engine->id_length()->propertyKey(), Heap::ArrayObject::LengthPropertyIndex));
        ScopedProperty lp(scope);
        InternalClassEntry e = a->internalClass()->find(scope.engine->id_length()->propertyKey());
        a->getProperty(e, lp);
        if (attrs.isEmpty() || p->isSubset(attrs, lp, e.attributes))
            return true;
        if (!e.attributes.isWritable() || attrs.type() == PropertyAttributes::Accessor || attrs.isConfigurable() || attrs.isEnumerable())
            return false;
        bool succeeded = true;
        if (attrs.type() == PropertyAttributes::Data) {
            bool ok;
            uint l = p->value.asArrayLength(&ok);
            if (!ok) {
                ScopedValue v(scope, p->value);
                engine->throwRangeError(v);
                return false;
            }
            succeeded = a->setArrayLength(l);
        }
        if (attrs.hasWritable() && !attrs.isWritable()) {
            e.attributes.setWritable(false);
            Heap::InternalClass::changeMember(a, engine->id_length()->propertyKey(), e.attributes);
        }
        if (!succeeded)
            return false;
        return true;
    }
    return Object::virtualDefineOwnProperty(m, id, p, attrs);
}