tor-browser

Proxy.cpp (35859B)

---

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
* vim: set ts=8 sts=2 et sw=2 tw=80:
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "js/Proxy.h"

#include "mozilla/Attributes.h"
#include "mozilla/Maybe.h"

#include <string.h>

#include "js/friend/ErrorMessages.h"  // JSMSG_*
#include "js/friend/StackLimits.h"  // js::AutoCheckRecursionLimit, js::GetNativeStackLimit
#include "js/friend/WindowProxy.h"  // js::IsWindow, js::IsWindowProxy, js::ToWindowProxyIfWindow
#include "js/PropertySpec.h"
#include "js/Value.h"  // JS::ObjectValue
#include "js/Wrapper.h"
#include "proxy/DeadObjectProxy.h"
#include "proxy/ScriptedProxyHandler.h"
#include "vm/Compartment.h"
#include "vm/Interpreter.h"  // js::CallGetter
#include "vm/JSContext.h"
#include "vm/JSFunction.h"
#include "vm/JSObject.h"
#include "vm/WrapperObject.h"

#include "gc/Marking-inl.h"
#include "vm/JSObject-inl.h"
#include "vm/NativeObject-inl.h"

using namespace js;

// Used by private fields to manipulate the ProxyExpando:
// All the following methods are called iff the handler for the proxy
// returns true for useProxyExpandoObjectForPrivateFields.
static bool ProxySetOnExpando(JSContext* cx, HandleObject proxy, HandleId id,
                             HandleValue v, HandleValue receiver,
                             ObjectOpResult& result) {
 MOZ_ASSERT(id.isPrivateName());

 // For BaseProxyHandler, private names are stored in the expando object.
 RootedObject expando(cx, proxy->as<ProxyObject>().expando().toObjectOrNull());

 // SetPrivateElementOperation checks for hasOwn first, which ensures the
 // expando exsists.
 //
 // If we don't have an expando, then we're probably misusing debugger apis and
 // should just throw.
 if (!expando) {
   JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
                             JSMSG_SET_MISSING_PRIVATE);
   return false;
 }

 Rooted<mozilla::Maybe<PropertyDescriptor>> ownDesc(cx);
 if (!GetOwnPropertyDescriptor(cx, expando, id, &ownDesc)) {
   return false;
 }
 if (ownDesc.isNothing()) {
   JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
                             JSMSG_SET_MISSING_PRIVATE);
   return false;
 }

 RootedValue expandoValue(cx, proxy->as<ProxyObject>().expando());
 return SetPropertyIgnoringNamedGetter(cx, expando, id, v, expandoValue,
                                       ownDesc, result);
}

static bool ProxyGetOwnPropertyDescriptorFromExpando(
   JSContext* cx, HandleObject proxy, HandleId id,
   MutableHandle<mozilla::Maybe<PropertyDescriptor>> desc) {
 RootedObject expando(cx, proxy->as<ProxyObject>().expando().toObjectOrNull());

 if (!expando) {
   return true;
 }

 return GetOwnPropertyDescriptor(cx, expando, id, desc);
}

static bool ProxyGetOnExpando(JSContext* cx, HandleObject proxy,
                             HandleValue receiver, HandleId id,
                             MutableHandleValue vp) {
 // For BaseProxyHandler, private names are stored in the expando object.
 RootedObject expando(cx, proxy->as<ProxyObject>().expando().toObjectOrNull());

 // We must have the expando, or GetPrivateElemOperation didn't call
 // hasPrivate first.
 if (!expando) {
   JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
                             JSMSG_GET_MISSING_PRIVATE);
   return false;
 }

 // Because we controlled the creation of the expando, we know it's not a
 // proxy, and so can safely call internal methods on it without worrying about
 // exposing information about private names.
 Rooted<mozilla::Maybe<PropertyDescriptor>> desc(cx);
 if (!GetOwnPropertyDescriptor(cx, expando, id, &desc)) {
   return false;
 }
 // We must have the object, same reasoning as the expando.
 if (desc.isNothing()) {
   JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
                             JSMSG_SET_MISSING_PRIVATE);
   return false;
 }

 // If the private name has a getter, delegate to that.
 if (desc->hasGetter()) {
   RootedValue getter(cx, JS::ObjectValue(*desc->getter()));
   return js::CallGetter(cx, receiver, getter, vp);
 }

 MOZ_ASSERT(desc->hasValue());
 MOZ_ASSERT(desc->isDataDescriptor());

 vp.set(desc->value());
 return true;
}

static bool ProxyHasOnExpando(JSContext* cx, HandleObject proxy, HandleId id,
                             bool* bp) {
 // For BaseProxyHandler, private names are stored in the expando object.
 RootedObject expando(cx, proxy->as<ProxyObject>().expando().toObjectOrNull());

 // If there is no expando object, then there is no private field.
 if (!expando) {
   *bp = false;
   return true;
 }

 return HasOwnProperty(cx, expando, id, bp);
}

static bool ProxyDefineOnExpando(JSContext* cx, HandleObject proxy, HandleId id,
                                Handle<PropertyDescriptor> desc,
                                ObjectOpResult& result) {
 MOZ_ASSERT(id.isPrivateName());

 // For BaseProxyHandler, private names are stored in the expando object.
 RootedObject expando(cx, proxy->as<ProxyObject>().expando().toObjectOrNull());

 if (!expando) {
   expando = NewPlainObjectWithProto(cx, nullptr);
   if (!expando) {
     return false;
   }

   proxy->as<ProxyObject>().setExpando(expando);
 }

 return DefineProperty(cx, expando, id, desc, result);
}

void js::AutoEnterPolicy::reportErrorIfExceptionIsNotPending(JSContext* cx,
                                                            HandleId id) {
 if (JS_IsExceptionPending(cx)) {
   return;
 }

 if (id.isVoid()) {
   ReportAccessDenied(cx);
 } else {
   Throw(cx, id, JSMSG_PROPERTY_ACCESS_DENIED);
 }
}

#ifdef DEBUG
void js::AutoEnterPolicy::recordEnter(JSContext* cx, HandleObject proxy,
                                     HandleId id, Action act) {
 if (allowed()) {
   context = cx;
   enteredProxy.emplace(proxy);
   enteredId.emplace(id);
   enteredAction = act;
   prev = cx->enteredPolicy;
   cx->enteredPolicy = this;
 }
}

void js::AutoEnterPolicy::recordLeave() {
 if (enteredProxy) {
   MOZ_ASSERT(context->enteredPolicy == this);
   context->enteredPolicy = prev;
 }
}

JS_PUBLIC_API void js::assertEnteredPolicy(JSContext* cx, JSObject* proxy,
                                          jsid id,
                                          BaseProxyHandler::Action act) {
 MOZ_ASSERT(proxy->is<ProxyObject>());
 MOZ_ASSERT(cx->enteredPolicy);
 MOZ_ASSERT(cx->enteredPolicy->enteredProxy->get() == proxy);
 MOZ_ASSERT(cx->enteredPolicy->enteredId->get() == id);
 MOZ_ASSERT(cx->enteredPolicy->enteredAction & act);
}
#endif

bool Proxy::getOwnPropertyDescriptor(
   JSContext* cx, HandleObject proxy, HandleId id,
   MutableHandle<mozilla::Maybe<PropertyDescriptor>> desc) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 desc.reset();  // default result if we refuse to perform this action
 AutoEnterPolicy policy(cx, handler, proxy, id,
                        BaseProxyHandler::GET_PROPERTY_DESCRIPTOR, true);
 if (!policy.allowed()) {
   return policy.returnValue();
 }

 if (handler->useProxyExpandoObjectForPrivateFields() && id.isPrivateName()) {
   return ProxyGetOwnPropertyDescriptorFromExpando(cx, proxy, id, desc);
 }
 return handler->getOwnPropertyDescriptor(cx, proxy, id, desc);
}

bool Proxy::defineProperty(JSContext* cx, HandleObject proxy, HandleId id,
                          Handle<PropertyDescriptor> desc,
                          ObjectOpResult& result) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();

 // We shouldn't be definining a private field if we are supposed to throw;
 // this ought to have been caught by CheckPrivateField.
 MOZ_ASSERT_IF(id.isPrivateName(), !handler->throwOnPrivateField());

 AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::SET, true);
 if (!policy.allowed()) {
   if (!policy.returnValue()) {
     return false;
   }
   return result.succeed();
 }

 // Private field accesses have different semantics depending on the kind
 // of proxy involved, and so take a different path compared to regular
 // [[Get]] operations. For example, scripted handlers don't fire traps
 // when accessing private fields (because of the WeakMap semantics)
 if (id.isPrivateName() && handler->useProxyExpandoObjectForPrivateFields()) {
   return ProxyDefineOnExpando(cx, proxy, id, desc, result);
 }

 return proxy->as<ProxyObject>().handler()->defineProperty(cx, proxy, id, desc,
                                                           result);
}

bool Proxy::ownPropertyKeys(JSContext* cx, HandleObject proxy,
                           MutableHandleIdVector props) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 AutoEnterPolicy policy(cx, handler, proxy, JS::VoidHandlePropertyKey,
                        BaseProxyHandler::ENUMERATE, true);
 if (!policy.allowed()) {
   return policy.returnValue();
 }
 return proxy->as<ProxyObject>().handler()->ownPropertyKeys(cx, proxy, props);
}

bool Proxy::delete_(JSContext* cx, HandleObject proxy, HandleId id,
                   ObjectOpResult& result) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::SET, true);
 if (!policy.allowed()) {
   bool ok = policy.returnValue();
   if (ok) {
     result.succeed();
   }
   return ok;
 }

 // Private names shouldn't take this path, as deleting a private name
 // should be a syntax error.
 MOZ_ASSERT(!id.isPrivateName());

 return proxy->as<ProxyObject>().handler()->delete_(cx, proxy, id, result);
}

JS_PUBLIC_API bool js::AppendUnique(JSContext* cx, MutableHandleIdVector base,
                                   HandleIdVector others) {
 RootedIdVector uniqueOthers(cx);
 if (!uniqueOthers.reserve(others.length())) {
   return false;
 }
 for (size_t i = 0; i < others.length(); ++i) {
   bool unique = true;
   for (size_t j = 0; j < base.length(); ++j) {
     if (others[i].get() == base[j]) {
       unique = false;
       break;
     }
   }
   if (unique) {
     if (!uniqueOthers.append(others[i])) {
       return false;
     }
   }
 }
 return base.appendAll(std::move(uniqueOthers));
}

/* static */
bool Proxy::getPrototype(JSContext* cx, HandleObject proxy,
                        MutableHandleObject proto) {
 MOZ_ASSERT(proxy->hasDynamicPrototype());
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 return proxy->as<ProxyObject>().handler()->getPrototype(cx, proxy, proto);
}

/* static */
bool Proxy::setPrototype(JSContext* cx, HandleObject proxy, HandleObject proto,
                        ObjectOpResult& result) {
 MOZ_ASSERT(proxy->hasDynamicPrototype());
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 return proxy->as<ProxyObject>().handler()->setPrototype(cx, proxy, proto,
                                                         result);
}

/* static */
bool Proxy::getPrototypeIfOrdinary(JSContext* cx, HandleObject proxy,
                                  bool* isOrdinary,
                                  MutableHandleObject proto) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 return proxy->as<ProxyObject>().handler()->getPrototypeIfOrdinary(
     cx, proxy, isOrdinary, proto);
}

/* static */
bool Proxy::setImmutablePrototype(JSContext* cx, HandleObject proxy,
                                 bool* succeeded) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 return handler->setImmutablePrototype(cx, proxy, succeeded);
}

/* static */
bool Proxy::preventExtensions(JSContext* cx, HandleObject proxy,
                             ObjectOpResult& result) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 return handler->preventExtensions(cx, proxy, result);
}

/* static */
bool Proxy::isExtensible(JSContext* cx, HandleObject proxy, bool* extensible) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 return proxy->as<ProxyObject>().handler()->isExtensible(cx, proxy,
                                                         extensible);
}

bool Proxy::has(JSContext* cx, HandleObject proxy, HandleId id, bool* bp) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 *bp = false;  // default result if we refuse to perform this action
 AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::GET, true);
 if (!policy.allowed()) {
   return policy.returnValue();
 }

 // Private names shouldn't take this path, but only hasOwn;
 MOZ_ASSERT(!id.isPrivateName());

 if (handler->hasPrototype()) {
   if (!handler->hasOwn(cx, proxy, id, bp)) {
     return false;
   }
   if (*bp) {
     return true;
   }

   RootedObject proto(cx);
   if (!GetPrototype(cx, proxy, &proto)) {
     return false;
   }
   if (!proto) {
     return true;
   }

   return HasProperty(cx, proto, id, bp);
 }

 return handler->has(cx, proxy, id, bp);
}

bool js::ProxyHas(JSContext* cx, HandleObject proxy, HandleValue idVal,
                 bool* result) {
 RootedId id(cx);
 if (!ToPropertyKey(cx, idVal, &id)) {
   return false;
 }

 return Proxy::has(cx, proxy, id, result);
}

bool Proxy::hasOwn(JSContext* cx, HandleObject proxy, HandleId id, bool* bp) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 *bp = false;  // default result if we refuse to perform this action

 // If the handler is supposed to throw, we'll never have a private field so
 // simply return, as we shouldn't throw an invalid security error when
 // checking for the presence of a private field (WeakMap model).
 if (id.isPrivateName() && handler->throwOnPrivateField()) {
   return true;
 }

 AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::GET, true);
 if (!policy.allowed()) {
   return policy.returnValue();
 }

 // Private field accesses have different semantics depending on the kind
 // of proxy involved, and so take a different path compared to regular
 // [[Get]] operations. For example, scripted handlers don't fire traps
 // when accessing private fields (because of the WeakMap semantics)
 if (id.isPrivateName() && handler->useProxyExpandoObjectForPrivateFields()) {
   return ProxyHasOnExpando(cx, proxy, id, bp);
 }

 return handler->hasOwn(cx, proxy, id, bp);
}

bool js::ProxyHasOwn(JSContext* cx, HandleObject proxy, HandleValue idVal,
                    bool* result) {
 RootedId id(cx);
 if (!ToPropertyKey(cx, idVal, &id)) {
   return false;
 }

 return Proxy::hasOwn(cx, proxy, id, result);
}

static MOZ_ALWAYS_INLINE Value ValueToWindowProxyIfWindow(const Value& v,
                                                         JSObject* proxy) {
 if (v.isObject() && v != ObjectValue(*proxy)) {
   return ObjectValue(*ToWindowProxyIfWindow(&v.toObject()));
 }
 return v;
}

MOZ_ALWAYS_INLINE bool Proxy::getInternal(JSContext* cx, HandleObject proxy,
                                         HandleValue receiver, HandleId id,
                                         MutableHandleValue vp) {
 MOZ_ASSERT_IF(receiver.isObject(), !IsWindow(&receiver.toObject()));

 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();

 // Shouldn't have gotten here, as this should have been caught earlier.
 MOZ_ASSERT_IF(id.isPrivateName(), !handler->throwOnPrivateField());

 vp.setUndefined();  // default result if we refuse to perform this action
 AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::GET, true);
 if (!policy.allowed()) {
   return policy.returnValue();
 }

 // Private field accesses have different semantics depending on the kind
 // of proxy involved, and so take a different path compared to regular
 // [[Get]] operations. For example, scripted handlers don't fire traps
 // when accessing private fields (because of the WeakMap semantics)
 if (id.isPrivateName() && handler->useProxyExpandoObjectForPrivateFields()) {
   return ProxyGetOnExpando(cx, proxy, receiver, id, vp);
 }

 if (handler->hasPrototype()) {
   bool own;
   if (!handler->hasOwn(cx, proxy, id, &own)) {
     return false;
   }
   if (!own) {
     RootedObject proto(cx);
     if (!GetPrototype(cx, proxy, &proto)) {
       return false;
     }
     if (!proto) {
       return true;
     }
     return GetProperty(cx, proto, receiver, id, vp);
   }
 }

 return handler->get(cx, proxy, receiver, id, vp);
}

bool Proxy::get(JSContext* cx, HandleObject proxy, HandleValue receiver_,
               HandleId id, MutableHandleValue vp) {
 // Use the WindowProxy as receiver if receiver_ is a Window. Proxy handlers
 // shouldn't have to know about the Window/WindowProxy distinction.
 RootedValue receiver(cx, ValueToWindowProxyIfWindow(receiver_, proxy));
 return getInternal(cx, proxy, receiver, id, vp);
}

bool js::ProxyGetProperty(JSContext* cx, HandleObject proxy, HandleId id,
                         MutableHandleValue vp) {
 RootedValue receiver(cx, ObjectValue(*proxy));
 return Proxy::getInternal(cx, proxy, receiver, id, vp);
}

bool js::ProxyGetPropertyByValue(JSContext* cx, HandleObject proxy,
                                HandleValue idVal, MutableHandleValue vp) {
 RootedId id(cx);
 if (!ToPropertyKey(cx, idVal, &id)) {
   return false;
 }

 RootedValue receiver(cx, ObjectValue(*proxy));
 return Proxy::getInternal(cx, proxy, receiver, id, vp);
}

MOZ_ALWAYS_INLINE bool Proxy::setInternal(JSContext* cx, HandleObject proxy,
                                         HandleId id, HandleValue v,
                                         HandleValue receiver,
                                         ObjectOpResult& result) {
 MOZ_ASSERT_IF(receiver.isObject(), !IsWindow(&receiver.toObject()));

 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }

 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();

 // Should have been handled already.
 MOZ_ASSERT_IF(id.isPrivateName(), !handler->throwOnPrivateField());

 AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::SET, true);
 if (!policy.allowed()) {
   if (!policy.returnValue()) {
     return false;
   }
   return result.succeed();
 }

 // Private field accesses have different semantics depending on the kind
 // of proxy involved, and so take a different path compared to regular
 // [[Set]] operations.
 //
 // This doesn't interact with hasPrototype, as PrivateFields are always
 // own propertiers, and so we never deal with prototype traversals.
 if (id.isPrivateName() && handler->useProxyExpandoObjectForPrivateFields()) {
   return ProxySetOnExpando(cx, proxy, id, v, receiver, result);
 }

 // Special case. See the comment on BaseProxyHandler::mHasPrototype.
 if (handler->hasPrototype()) {
   return handler->BaseProxyHandler::set(cx, proxy, id, v, receiver, result);
 }

 return handler->set(cx, proxy, id, v, receiver, result);
}

bool Proxy::set(JSContext* cx, HandleObject proxy, HandleId id, HandleValue v,
               HandleValue receiver_, ObjectOpResult& result) {
 // Use the WindowProxy as receiver if receiver_ is a Window. Proxy handlers
 // shouldn't have to know about the Window/WindowProxy distinction.
 RootedValue receiver(cx, ValueToWindowProxyIfWindow(receiver_, proxy));
 return setInternal(cx, proxy, id, v, receiver, result);
}

bool js::ProxySetProperty(JSContext* cx, HandleObject proxy, HandleId id,
                         HandleValue val, bool strict) {
 ObjectOpResult result;
 RootedValue receiver(cx, ObjectValue(*proxy));
 if (!Proxy::setInternal(cx, proxy, id, val, receiver, result)) {
   return false;
 }
 return result.checkStrictModeError(cx, proxy, id, strict);
}

bool js::ProxySetPropertyByValue(JSContext* cx, HandleObject proxy,
                                HandleValue idVal, HandleValue val,
                                bool strict) {
 RootedId id(cx);
 if (!ToPropertyKey(cx, idVal, &id)) {
   return false;
 }

 ObjectOpResult result;
 RootedValue receiver(cx, ObjectValue(*proxy));
 if (!Proxy::setInternal(cx, proxy, id, val, receiver, result)) {
   return false;
 }
 return result.checkStrictModeError(cx, proxy, id, strict);
}

bool Proxy::getOwnEnumerablePropertyKeys(JSContext* cx, HandleObject proxy,
                                        MutableHandleIdVector props) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 AutoEnterPolicy policy(cx, handler, proxy, JS::VoidHandlePropertyKey,
                        BaseProxyHandler::ENUMERATE, true);
 if (!policy.allowed()) {
   return policy.returnValue();
 }
 return handler->getOwnEnumerablePropertyKeys(cx, proxy, props);
}

bool Proxy::enumerate(JSContext* cx, HandleObject proxy,
                     MutableHandleIdVector props) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }

 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 if (handler->hasPrototype()) {
   if (!Proxy::getOwnEnumerablePropertyKeys(cx, proxy, props)) {
     return false;
   }

   RootedObject proto(cx);
   if (!GetPrototype(cx, proxy, &proto)) {
     return false;
   }
   if (!proto) {
     return true;
   }

   cx->check(proxy, proto);

   RootedIdVector protoProps(cx);
   if (!GetPropertyKeys(cx, proto, 0, &protoProps)) {
     return false;
   }
   return AppendUnique(cx, props, protoProps);
 }

 AutoEnterPolicy policy(cx, handler, proxy, JS::VoidHandlePropertyKey,
                        BaseProxyHandler::ENUMERATE, true);

 // If the policy denies access but wants us to return true, we need
 // to return an empty |props| list.
 if (!policy.allowed()) {
   MOZ_ASSERT(props.empty());
   return policy.returnValue();
 }

 return handler->enumerate(cx, proxy, props);
}

bool Proxy::call(JSContext* cx, HandleObject proxy, const CallArgs& args) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();

 // Because vp[0] is JS_CALLEE on the way in and JS_RVAL on the way out, we
 // can only set our default value once we're sure that we're not calling the
 // trap.
 AutoEnterPolicy policy(cx, handler, proxy, JS::VoidHandlePropertyKey,
                        BaseProxyHandler::CALL, true);
 if (!policy.allowed()) {
   args.rval().setUndefined();
   return policy.returnValue();
 }

 return handler->call(cx, proxy, args);
}

bool Proxy::construct(JSContext* cx, HandleObject proxy, const CallArgs& args) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();

 // Because vp[0] is JS_CALLEE on the way in and JS_RVAL on the way out, we
 // can only set our default value once we're sure that we're not calling the
 // trap.
 AutoEnterPolicy policy(cx, handler, proxy, JS::VoidHandlePropertyKey,
                        BaseProxyHandler::CALL, true);
 if (!policy.allowed()) {
   args.rval().setUndefined();
   return policy.returnValue();
 }

 return handler->construct(cx, proxy, args);
}

bool Proxy::nativeCall(JSContext* cx, IsAcceptableThis test, NativeImpl impl,
                      const CallArgs& args) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 RootedObject proxy(cx, &args.thisv().toObject());
 // Note - we don't enter a policy here because our security architecture
 // guards against nativeCall by overriding the trap itself in the right
 // circumstances.
 return proxy->as<ProxyObject>().handler()->nativeCall(cx, test, impl, args);
}

bool Proxy::getBuiltinClass(JSContext* cx, HandleObject proxy, ESClass* cls) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 return proxy->as<ProxyObject>().handler()->getBuiltinClass(cx, proxy, cls);
}

bool Proxy::isArray(JSContext* cx, HandleObject proxy,
                   JS::IsArrayAnswer* answer) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 return proxy->as<ProxyObject>().handler()->isArray(cx, proxy, answer);
}

const char* Proxy::className(JSContext* cx, HandleObject proxy) {
 // Check for unbounded recursion, but don't signal an error; className
 // needs to be infallible.
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.checkDontReport(cx)) {
   return "too much recursion";
 }

 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 AutoEnterPolicy policy(cx, handler, proxy, JS::VoidHandlePropertyKey,
                        BaseProxyHandler::GET, /* mayThrow = */ false);
 // Do the safe thing if the policy rejects.
 if (!policy.allowed()) {
   return handler->BaseProxyHandler::className(cx, proxy);
 }
 return handler->className(cx, proxy);
}

JSString* Proxy::fun_toString(JSContext* cx, HandleObject proxy,
                             bool isToSource) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return nullptr;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 AutoEnterPolicy policy(cx, handler, proxy, JS::VoidHandlePropertyKey,
                        BaseProxyHandler::GET, /* mayThrow = */ false);
 // Do the safe thing if the policy rejects.
 if (!policy.allowed()) {
   return handler->BaseProxyHandler::fun_toString(cx, proxy, isToSource);
 }
 return handler->fun_toString(cx, proxy, isToSource);
}

RegExpShared* Proxy::regexp_toShared(JSContext* cx, HandleObject proxy) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return nullptr;
 }
 return proxy->as<ProxyObject>().handler()->regexp_toShared(cx, proxy);
}

bool Proxy::boxedValue_unbox(JSContext* cx, HandleObject proxy,
                            MutableHandleValue vp) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 return proxy->as<ProxyObject>().handler()->boxedValue_unbox(cx, proxy, vp);
}

JSObject* const TaggedProto::LazyProto = reinterpret_cast<JSObject*>(0x1);

/* static */
bool Proxy::getElements(JSContext* cx, HandleObject proxy, uint32_t begin,
                       uint32_t end, ElementAdder* adder) {
 AutoCheckRecursionLimit recursion(cx);
 if (!recursion.check(cx)) {
   return false;
 }
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 AutoEnterPolicy policy(cx, handler, proxy, JS::VoidHandlePropertyKey,
                        BaseProxyHandler::GET,
                        /* mayThrow = */ true);
 if (!policy.allowed()) {
   if (policy.returnValue()) {
     MOZ_ASSERT(!cx->isExceptionPending());
     return js::GetElementsWithAdder(cx, proxy, proxy, begin, end, adder);
   }
   return false;
 }
 return handler->getElements(cx, proxy, begin, end, adder);
}

/* static */
void Proxy::trace(JSTracer* trc, JSObject* proxy) {
 const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
 handler->trace(trc, proxy);
}

static bool proxy_LookupProperty(JSContext* cx, HandleObject obj, HandleId id,
                                MutableHandleObject objp,
                                PropertyResult* propp) {
 bool found;
 if (!Proxy::has(cx, obj, id, &found)) {
   return false;
 }

 if (found) {
   propp->setProxyProperty();
   objp.set(obj);
 } else {
   propp->setNotFound();
   objp.set(nullptr);
 }
 return true;
}

static bool proxy_DeleteProperty(JSContext* cx, HandleObject obj, HandleId id,
                                ObjectOpResult& result) {
 if (!Proxy::delete_(cx, obj, id, result)) {
   return false;
 }
 return SuppressDeletedProperty(cx, obj, id);  // XXX is this necessary?
}

/* static */
void ProxyObject::traceEdgeToTarget(JSTracer* trc, ProxyObject* obj) {
 TraceCrossCompartmentEdge(trc, obj, obj->slotOfPrivate(), "proxy target");
}

#ifdef DEBUG
static inline void CheckProxyIsInCCWMap(ProxyObject* proxy) {
 if (proxy->zone()->isGCCompacting()) {
   // Skip this check during compacting GC since objects' shapes and base
   // shapes may be forwarded. It's not impossible to make this work, but
   // requires adding a parallel lookupWrapper() path for this one case.
   return;
 }

 JSObject* referent = MaybeForwarded(proxy->target());
 if (referent->compartment() != proxy->compartment()) {
   // Assert that this proxy is tracked in the wrapper map. We maintain the
   // invariant that the wrapped object is the key in the wrapper map.
   ObjectWrapperMap::Ptr p = proxy->compartment()->lookupWrapper(referent);
   MOZ_ASSERT(p);
   MOZ_ASSERT(*p->value().unsafeGet() == proxy);
 }
}
#endif

/* static */
void ProxyObject::trace(JSTracer* trc, JSObject* obj) {
 ProxyObject* proxy = &obj->as<ProxyObject>();

 TraceNullableEdge(trc, proxy->slotOfExpando(), "expando");

#ifdef DEBUG
 JSContext* cx = TlsContext.get();
 if (cx && cx->isStrictProxyCheckingEnabled() && proxy->is<WrapperObject>()) {
   CheckProxyIsInCCWMap(proxy);
 }
#endif

 // Note: If you add new slots here, make sure to change
 // nuke() to cope.

 traceEdgeToTarget(trc, proxy);

 size_t nreserved = proxy->numReservedSlots();
 for (size_t i = 0; i < nreserved; i++) {
   /*
    * The GC can use the second reserved slot to link the cross compartment
    * wrappers into a linked list, in which case we don't want to trace it.
    */
   if (proxy->is<CrossCompartmentWrapperObject>() &&
       i == CrossCompartmentWrapperObject::GrayLinkReservedSlot) {
     continue;
   }
   TraceEdge(trc, proxy->reservedSlotPtr(i), "proxy_reserved");
 }

 Proxy::trace(trc, obj);
}

static void proxy_Finalize(JS::GCContext* gcx, JSObject* obj) {
 // Suppress a bogus warning about finalize().
 JS::AutoSuppressGCAnalysis nogc;

 MOZ_ASSERT(obj->is<ProxyObject>());
 ProxyObject* proxy = &obj->as<ProxyObject>();
 proxy->handler()->finalize(gcx, obj);

 if (!proxy->usingInlineValueArray() && proxy->isTenured()) {
   auto* valArray = js::detail::GetProxyDataLayout(obj)->values();
   size_t size =
       js::detail::ProxyValueArray::sizeOf(proxy->numReservedSlots());
   gcx->free_(obj, valArray, size, MemoryUse::ProxyExternalValueArray);
 }
}

size_t js::proxy_ObjectMoved(JSObject* obj, JSObject* old) {
 ProxyObject& proxy = obj->as<ProxyObject>();

 if (IsInsideNursery(old)) {
   proxy.nurseryProxyTenured(&old->as<ProxyObject>());
 }

 return proxy.handler()->objectMoved(obj, old);
}

void ProxyObject::nurseryProxyTenured(ProxyObject* old) {
 if (old->usingInlineValueArray()) {
   setInlineValueArray();
   return;
 }

 Nursery& nursery = runtimeFromMainThread()->gc.nursery();
 nursery.removeMallocedBufferDuringMinorGC(data.values());

 size_t size = detail::ProxyValueArray::sizeOf(numReservedSlots());
 AddCellMemory(this, size, MemoryUse::ProxyExternalValueArray);
}

const JSClassOps js::ProxyClassOps = {
   nullptr,             // addProperty
   nullptr,             // delProperty
   nullptr,             // enumerate
   nullptr,             // newEnumerate
   nullptr,             // resolve
   nullptr,             // mayResolve
   proxy_Finalize,      // finalize
   nullptr,             // call
   nullptr,             // construct
   ProxyObject::trace,  // trace
};

const ClassExtension js::ProxyClassExtension = {
   proxy_ObjectMoved,  // objectMovedOp
};

const ObjectOps js::ProxyObjectOps = {
   proxy_LookupProperty,             // lookupProperty
   Proxy::defineProperty,            // defineProperty
   Proxy::has,                       // hasProperty
   Proxy::get,                       // getProperty
   Proxy::set,                       // setProperty
   Proxy::getOwnPropertyDescriptor,  // getOwnPropertyDescriptor
   proxy_DeleteProperty,             // deleteProperty
   Proxy::getElements,               // getElements
   Proxy::fun_toString,              // funToString
};

static const JSFunctionSpec proxy_static_methods[] = {
   JS_FN("revocable", proxy_revocable, 2, 0),
   JS_FS_END,
};

static const ClassSpec ProxyClassSpec = {
   GenericCreateConstructor<js::proxy, 2, gc::AllocKind::FUNCTION>,
   nullptr,
   proxy_static_methods,
   nullptr,
};

const JSClass js::ProxyClass = PROXY_CLASS_DEF_WITH_CLASS_SPEC(
   "Proxy",
   JSCLASS_HAS_CACHED_PROTO(JSProto_Proxy) | JSCLASS_HAS_RESERVED_SLOTS(2),
   &ProxyClassSpec);

JS_PUBLIC_API JSObject* js::NewProxyObject(JSContext* cx,
                                          const BaseProxyHandler* handler,
                                          HandleValue priv, JSObject* proto_,
                                          const ProxyOptions& options) {
 AssertHeapIsIdle();
 CHECK_THREAD(cx);

 // This can be called from the compartment wrap hooks while in a realm with a
 // gray global. Trigger the read barrier on the global to ensure this is
 // unmarked.
 cx->realm()->maybeGlobal();

 if (proto_ != TaggedProto::LazyProto) {
   cx->check(proto_);  // |priv| might be cross-compartment.
 }

 if (options.lazyProto()) {
   MOZ_ASSERT(!proto_);
   proto_ = TaggedProto::LazyProto;
 }

 return ProxyObject::New(cx, handler, priv, TaggedProto(proto_),
                         options.clasp());
}

void ProxyObject::renew(const BaseProxyHandler* handler, const Value& priv) {
 MOZ_ASSERT_IF(IsCrossCompartmentWrapper(this), IsDeadProxyObject(this));
 MOZ_ASSERT(getClass() == &ProxyClass);
 MOZ_ASSERT(!IsWindowProxy(this));
 MOZ_ASSERT(hasDynamicPrototype());

 setHandler(handler);
 setCrossCompartmentPrivate(priv);
 for (size_t i = 0; i < numReservedSlots(); i++) {
   setReservedSlot(i, UndefinedValue());
 }
}

// This implementation of HostEnsureCanAddPrivateElement is designed to work in
// collaboration with Gecko to support the HTML implementation, which applies
// only to Proxy type objects, and as a result we can simply provide proxy
// handlers to correctly match the required semantics.
bool DefaultHostEnsureCanAddPrivateElementCallback(JSContext* cx,
                                                  HandleValue val) {
 if (!val.isObject()) {
   return true;
 }

 Rooted<JSObject*> valObj(cx, &val.toObject());
 if (!IsProxy(valObj)) {
   return true;
 }

 if (GetProxyHandler(valObj)->throwOnPrivateField()) {
   JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
                             JSMSG_ILLEGAL_PRIVATE_EXOTIC);
   return false;
 }
 return true;
}