aboutsummaryrefslogtreecommitdiffstats
path: root/src/qml/jsruntime/qv4objectproto.cpp
Commit message (Collapse)AuthorAgeFilesLines
* CRA review qml/jsruntimeFabian Kosmale2025-09-161-0/+1
| | | | | | | | | | | | | | | | | | This relies heavily on the documented fact that we only support trusted QML/JS content, meaning most files are only significant, not critical. This also extends to the handling of qmlc files (as in compilationunitmapper), as we store them in a user owned, non-shared cache directory – so any vulnerability there would already mean that an attacker has write-priviledges on user data. An exception is ArrayBuffer, which can be used with arbitrary user data, and should create a valid QBA. Fixes: QTBUG-136970 Pick-to: 6.10 6.9 6.8 QUIP: 23 Change-Id: I22033fe6ab4acf8362a8183e25b92331d45cb32c Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
* Reduce access to uninitialized scoped allocationsLuca Di Sera2025-07-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `Scope` provides a mean of performing uninitialized scoped allocations on the JS stack. This can generally be unsafe as this form of allocation temporarily leaves an element representing garbage memory on the JS stack, which could be accessed by other parts of the program. Indeed, a set of bugs related to this kind of behavior was recently solved. Hence, to reduce the surface of those kind of bugs, the usages of uninitialized scoped allocations were reduced to a minimum. The solution to the recent set of bugs related to uninitialized scoped allocations introduced a series of `construct` methods that ensure that the uninitialized allocation and the initialization of the allocated elements are performed as a single step of computation, reducing the surface for incorrect usages of those kind of allocations. The solution was expanded by the introduction of new `construct` methods that cover initialization from other types and some different means of initialization that were used around the code-base to work with uninitialized scoped allocations. Similarly, the various allocation methods in `Scope` were subsumed by the new `construct` methods, with the only remaining means of allocation being the uninitialized one that is used as a building block for the `construct` methods. In particular, `Scope` provided three forms of allocation under the various `alloc` methods. The aforementioned uninitialized allocation and an allocation that performed initialization to either the Undefined or the Empty value. The latter two forms of allocation were converted to forms of `construct`. Since they directly map to the same concept of allocation plus initialization, the conversion avoids having two names for the same concept. More specifically, the form of allocation that initialized to the Undefined value was converted to the new `constructUndefined` which keeps the same behavior. The different naming from the basic `construct` methods is justified by the different interface, which doesn't require choosing a initial value, and the different implementation which is built on the more general `construct` methods rather than the lower level allocation routines. The form of allocation that initialized to the Empty value was removed as it was found to be unused in the code-base. The converted allocation methods generally provides the same interface and behavior with the exception of always requiring the user to specify the amount of allocate objects. This is a change compared to the previous interface which allowed a zero-argument version that allocated a single element. The writer of the patch considered the additional terseness inconsequential compared to the required additional code so that the possibility was not preserved. The code related to the converted allocation forms was removed as a consequence of the conversion. The remaining uninitialized allocation form was made private, to avoid general usage outside of `Scope`, and favoring usages of the substitute `construct` methods. A comment that was related to usages of uninitialized scoped allocations was moved to the lower level `jsAlloca`, which forms the basis for those allocations and creates the abovementioned issues, where it was expanded upon. Usages of the non-uninitialized allocation forms around the code-base were modified to use the new `constructUndefined` method. Most usages of the uninitialized allocation form were modified to use the new `construct` methods that were added to replace them. Exceptions were made for those cases where the initialization routine is either very complex or depends on details that shouldn't belong to `Scope` such that they cannot be trivially encapsulated in a `construct` method. Instead, the relevant function or object was friended by `Scope` to allow accesses to the now private form of allocation. Those usages were previously checked and are supposed to be safe but should be scrutinized if they are modified or the code around them is modified. One of the friended functions, `callDatafromJs`, previously offered a default argument that was not made use of in the code-base. The default value for the argument was removed to simplify friending the function, considering the difficulty the language has with friended function with default arguments and considering that it would have required the default value to be moved out of the function definition into a forward declaration in the unrelated header that defines `Scope`. It is expected that the changes will reduce the surface of usage of uninitialized scoped allocations in favor of a slightly safer approach, make the issue that those usages can produce more apparent and generally centralize the usages as much as possible to make them easier to evaluate and keep track of. Change-Id: I351329f2c139201e0728791df6da297698170f55 Reviewed-by: Ulf Hermann <ulf.hermann@qt.io> Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
* V4: Slim down FunctionObjectUlf Hermann2024-05-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most FunctionObjects do not actually need their custom jsCall members. They will only call the functions from the vtable anyway. FunctionObject can therefore be split into a static and a dynamic variant. Only the dyanmic variant needs to carry (and invoke) the extra pointer. The jsCallWithMetaTypes pointer is completely pointless because none of the dynamic functions actually implement it. Furthermore, the QV4::Function and QV4::ExecutionContext pointers in FunctionObject are only needed by actual JavaScript functions. The builtins that like to be dynamic functions never need them. Therefore, split out another class for this. In the generic FunctionObject, we need the capability to decide at run time whether the function shall be a constructor or not. Add a flag to replace the check for jsCallAsConstructor. Also, where we can, avoid the pessimization of checking whether a function is a constructor before trying to call it as constructor. Rather have the default implementation throw the exception. As a side effect, for most functions we don't need an ExecutionContext anymore. The engine is enough. Task-number: QTBUG-124662 Change-Id: Iac657fa71288dd6ec230a33de2986ba3bcf4628c Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
* QtQml: Remove unused includes in qml, final partSemih Yavuz2022-09-141-3/+0
| | | | | | | | | | | | | | Drop unnecessary includes detected by clangd-iwyu. Add new includes due to the transitive includes. Also, some of the includes were detected as unused even if they were actually in use. In those cases, use angular brackets instead of "" which deceives the tool not to complain. Affected subfolders: JsRuntime, Qml Fixes: QTBUG-106473 Change-Id: I483da15d42a8e3ce6cd3b654909665fff3075d6b Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
* Use SPDX license identifiersLucie Gérard2022-06-111-39/+3
| | | | | | | | | | | | Replace the current license disclaimer in files by a SPDX-License-Identifier. Files that have to be modified by hand are modified. License files are organized under LICENSES directory. Pick-to: 6.4 Task-number: QTBUG-67283 Change-Id: I63563bbeb6f60f89d2c99660400dca7fab78a294 Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
* Use QV4::Scope::hasException() where applicableUlf Hermann2021-06-301-23/+23
| | | | | | | It is shorter and encapsulates the exception handling a bit. Change-Id: I8e2dc0eb3b930e222b8cb4852b73d99ca18a0379 Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
* V4: Check for exceptions before we use the result of a JS callUlf Hermann2020-01-231-1/+1
| | | | | | | | If the call resulted in an exception the return value is undefined. Task-number: QTBUG-81581 Change-Id: Ibfdd5e1229cf5437f270232d3b1a91308adeec72 Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
* QV4: Check recursion limit in toStringFabian Kosmale2020-01-071-0/+1
| | | | | Change-Id: I18b7a4e00150f6c47c991a5164901159b7f946b9 Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
* Clean up frozen(), sealed(), nonExtensible() and propertiesFrozen()Ulf Hermann2019-05-311-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | They all had some interesting bugs and duplicated each other: a, propertiesFrozen() changed each property individually, creating a lot of unnecessary intermediate classes. frozen() changed them all at once. b, If a class happened to contain only properties that matched the characteristics of being "sealed" or "frozen", sealed(), frozen() and propertiesFrozen() would set the flags in place and return the same class. This is bad because it violates the assumption that an InternalClass is immutable and it breaks the recursive freezing algorithm we rely on for the global object. It would stop freezing child objects at any such class, even if the children were not frozen. c, propertiesFrozen() did not set any of the flags even though it effectively sealed and froze the class. Therefore, when requesting the same class as frozen() it would iterate through all the properties again. d, frozen() implicitly also sealed the object and made it non-extensible. sealed() also implicitly made it non-extensible. This is impractical as we want to allow objects to be extensible even though all their properties are frozen. Therefore we only set the flag that belongs to each method now. We do know, however, that a frozen object is implicitly sealed. Therefore we can short-circuit this transition. Furthermore, we need to remove the assert in InternalClass::init() as you can indeed use frozen objects as prototypes for others, but that needs to be recorded in the original InternalClass via the isUsedAsProto flag. In order to set this flag, we need to perform a transition and therefore, derive from the old InternalClass. The JavaScript isFrozen() method asks for an _implicitly_, "duck typed", frozen state, which is different from what our "isFrozen" flag denotes. Therefore we add a separate const method that just checks whether all properties are frozen. Task-number: QTBUG-76033 Change-Id: I375fef83fb99035d470490fdf2348766b090831e Reviewed-by: Lars Knoll <lars.knoll@qt.io>
* Cleanups in Value/PrimitiveLars Knoll2018-09-171-16/+16
| | | | | | | | | | | | Get rid of Primitive and move the corresponding methods directly into Value. Mark many methods in Value as constexpr and turn Value into a POD type again. Keep Primitive as a pure alias to Value for source compatibility of other modules that might be using it. Change-Id: Icb47458947dd3482c8852e95782123ea4346f5ec Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Include symbols in getOwnPropertyKeysLars Knoll2018-09-091-9/+15
| | | | | | | And fix getOwnPropertySymbols and getOwnPropertyDescriptors. Change-Id: Ie0e4c3d308ffe8a904e9a6ab9242b2cda59d779f Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Fix handling of uninitialized exports when iterating module namespace objectsSimon Hausmann2018-08-291-1/+2
| | | | | | | | | | | | | | | | | | | | We must throw reference errors when the iteration reaches an uninitialized export. As with other module namespace cases we don't know at the call site that we're dealing with this special object, we must throw the reference error inside the iterator. That brings in the additional complexity that we can use the iterator to get a list of all names (should not throw) as well as to retrieve the values (throw on uninit). We make the distinction inside the ::next() function based on whether a Property pointer was provided, which requires slightly different variants inside the ObjectIterator that uses the internal iterator. On the upside this avoids value copying when they would be unused otherwise. Change-Id: Iac45d0ed39bea861ea92db875821225c0feb9391 Reviewed-by: Lars Knoll <lars.knoll@qt.io>
* Fix toLocaleString implementations in (Typed)Array.prototypeLars Knoll2018-08-231-1/+1
| | | | | Change-Id: Idcabd68b1651ad3cae315a16cb0e1361cba21253 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Implement support for Object.valuesLars Knoll2018-08-041-0/+29
| | | | | Change-Id: I1f2507afb1c6f148d129325088a7db9d9b6fc98e Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Add support for Object.getOwnPropertyDescriptorsLars Knoll2018-08-041-0/+30
| | | | | Change-Id: I9f80c583a5c238997b7141e11f4302a9e19c5499 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Add Object.entries()Lars Knoll2018-08-041-0/+40
| | | | | Change-Id: Ia06813a7cac5bd8be99e9f6ab3cd30eac26e499f Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Simplify ObjectIterator::nextLars Knoll2018-08-041-9/+4
| | | | | | | Use PropertyKey instead of two out pointers Change-Id: I4f57bcb36fd412f19f0ed116042f7b094b5785dc Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Fix some spec incompatibilities in Object.prototypeLars Knoll2018-08-021-8/+8
| | | | | Change-Id: I5f0533a443404276ebc79fc8a1fbb33bda38556f Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Fix the remaining test failures with non strict arguments objectsLars Knoll2018-07-301-2/+0
| | | | | Change-Id: Ib50f602263dd0146d792fb3d12bd5971585fda30 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Add support for super callsLars Knoll2018-07-031-3/+3
| | | | | | | | Implement super call support for class constructor functions. Change-Id: I3c64276234689cf4f644b095e0fc8ca1c634ac53 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Implement support for new.targetLars Knoll2018-07-031-1/+1
| | | | | | | | | Support the new.target meta property in the codegen, and add support for passing the newtarget into the constructor vtable methods and the execution context. Change-Id: I62ea58e5e92d894035a76e35776203e9837c383b Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Prefix vtable methods with virtualLars Knoll2018-07-031-2/+2
| | | | | | | | | Turns out that the overloading of vtable methods and regular ones is problematic in some cases. So let's rather make it explicit which methods are part of the vtable, and which aren't. Change-Id: Ifee32a26104d30f3c82bca8b5a9cdea2d4f4f526 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Replace Identifier by PropertyKeyLars Knoll2018-07-021-6/+6
| | | | | | | | Change all uses of Identifier to use the new PropertyKey class and get rid of Identifier. Change-Id: Ib7e83b06a3c923235e145b6e083fe980dc240452 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Introduce a PropertyKey class that inherits from ValueLars Knoll2018-07-021-8/+9
| | | | | | | | | | | This will replace Identifier over the next few commits. The advantage of PropertyKey is that it can be stored on the JS stack, so that a GC run won't accidentally clean up the string/symbol referenced by the key. Change-Id: Ib4daa4616bcfa537e6d371ef7c7740bc7727a50d Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Cleanups in the Identifier APILars Knoll2018-07-021-1/+1
| | | | | | | | | | Rename from/asHeapObject to from/asStringOrSymbol and fix the signature. Add a isStringOrSymbol() method and redefine isValid() to also include array indices. Change-Id: Ic8272bfbe84d15421e2ebe86ddda7fdaa8db4f3e Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Unify the get and getIndexed vtable functions of QV4::ObjectLars Knoll2018-07-021-1/+1
| | | | | | | | This finalizes the refactoring of Object's vtable API. Also added the receiver argument to the method as required by the ES7 spec. Change-Id: I36f9989211c47458788fe9f7e929862bcfe7b845 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Cleanup defineOwnPropertyLars Knoll2018-06-261-5/+5
| | | | | | | | | | | | | | | | Make it a vtable method as required by the ES7 spec. Change all calls sites to call through the virtual function. Adjust ArgumentsObject and give it it's own defineOwnProperty implementation instead of hacking it into the base implementation. Move the array object specific handling into a reimplementation. Change-Id: I48c960c4c69f99b178628c94b4808be2bab0dccc Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Add Proxy support for prototype handlingLars Knoll2018-06-251-33/+15
| | | | | | | | | | | | | | Cleanup get/setPrototypeOf and fix some smaller incompatibilities in the default implementation for Object. Add the methods to the vtable and reimplement them according to spec for ProxyObjects. Clean up the Object.prototype.get/setPrototypeOf/__proto__ methods and fix a smaller bug in the Reflect API for those methods. Change-Id: I6e438753332ec4db963d6cdcf86f340ff212777a Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Support preventExtensions in Proxy handlersLars Knoll2018-06-251-1/+1
| | | | | Change-Id: I03aaacc260bdb46eb09c597598a45fbb25d6d7b6 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Add virtual interface for hasPropertyLars Knoll2018-06-251-6/+6
| | | | | | | This is required to correctly support Proxy Change-Id: I95ec17e919915290a05ad9501cd649452ab82135 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Implement a virtual interface for getOwnPropertyLars Knoll2018-06-251-9/+4
| | | | | | | | | | | | This is required to support Proxy properly, and at the same time fixes a couple of test failures. The new interface also replaces the old query and queryIndexed virtual interfaces, as those where doing a subset of what getOwnProperty does. Change-Id: I750e366b475ce971d6d9edf35fa17b7a2b07f771 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Check that toObject() didn't failLars Knoll2018-06-211-0/+2
| | | | | | | | Avoid a crash below if the toObject call failed and threw an exception. Change-Id: I82a12c5cd8892c176d345d7f4b0cf3297357f272 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Implement ToPropertyKey() from the ES7 specLars Knoll2018-06-041-4/+4
| | | | | | | and use it where required. Change-Id: I309ca61e0360b26428fc2ea5a2eea47c8e0632a0 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Use Symbol.toStringTag in Object.prototype.toStringLars Knoll2018-06-041-10/+24
| | | | | | | | | This should make toString comply fully with the JS Spec. Also add a couple of missing Symbol.toStringTag properties. Change-Id: I29e2018b486a0e1d174b58ce7a14f0e42cc78767 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Implement Object.is and Object.getOwnPropertySymbolsLars Knoll2018-05-241-0/+31
| | | | | Change-Id: Id64f91f6bf1abbcfa28590a43fb4f8673db6730b Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Implement Object.setPrototypeOf()Lars Knoll2018-05-231-0/+25
| | | | | Change-Id: I4488ea4855a52bc7fd386d2eec8c35def83f2785 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Cleanup creation code for builtin functionsLars Knoll2018-05-021-5/+1
| | | | | | | | Centralize the code in FunctionObject::createBuiltinFunction and setup function names and length properties there. Change-Id: I21f1d42b475070ee091d96d97387149af1dc47f2 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Add SymbolObject, well known symbols and fix most remaining issuesLars Knoll2018-05-021-5/+5
| | | | | | | | | Added SymbolObject, the equivalent to StringObject which was still missing so far. Added the predefined standard symbols, and fixed most test failures related to symbols. Change-Id: I1e28b439e7c4f5141b4a09bd8fb666c60691f192 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Partial Symbol supportLars Knoll2018-05-021-3/+7
| | | | | | | | | Added basic infrastructure to create symbols and convert them back to strings. In addition, storing and retrieving of symbol based properties in Objects works. Change-Id: I185f7aa46e7afa19db5a801102142892e03b7bf1 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Smaller cleanupLars Knoll2018-05-021-13/+12
| | | | | | | get rid of some defineProperty usages Change-Id: I683b35b3042a0ba7f1b68235acaa6325c6acf2f1 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* use nullptr consistently (clang-tidy)Shawn Rutledge2018-02-261-1/+1
| | | | | | | | | | | | | From now on we prefer nullptr instead of 0 to clarify cases where we are assigning or testing a pointer rather than a numeric zero. Also, replaced cases where 0 was passed as Qt::KeyboardModifiers with Qt::NoModifier (clang-tidy replaced them with nullptr, which waas wrong, so it was just as well to make the tests more readable rather than to revert those lines). Change-Id: I4735d35e4d9f42db5216862ce091429eadc6e65d Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Get rid of BuiltinFunctionLars Knoll2018-01-151-2/+2
| | | | | | | It's now unused. Change-Id: Id2941c212d488c9b0933fa06aac9922b9db13a05 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* Convert runtime methods of Object to new calling conventionLars Knoll2017-11-131-96/+118
| | | | | Change-Id: Ic34164af0ad86347a791a56a438a71d458f198a4 Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>
* Change signature for call/callAsConstructorLars Knoll2017-11-071-8/+8
| | | | | Change-Id: I159b57acc7a2133ef1ad545aa84e792c63449a57 Reviewed-by: Lars Knoll <lars.knoll@qt.io>
* Rename the construct 'virtual' method to callAsConstructorLars Knoll2017-11-071-1/+1
| | | | | | | To make it consistent with the rest of the engine. Change-Id: I57b98fa26134f9864c663f47371ef3e9ca16ac9c Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>
* Further cleanup JSCallDataLars Knoll2017-11-071-1/+1
| | | | | | | Avoid allocations on the JS stack if possible Change-Id: I344cd6dceb6264314f9d22c94db22b22d1d24d14 Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>
* Simplify JSCallData constructionLars Knoll2017-11-071-1/+1
| | | | | Change-Id: Ic53532edae9a209aa7125af6f00a9d993d74f1a3 Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>
* Get rid of JSCallData::call()Lars Knoll2017-11-071-3/+3
| | | | | Change-Id: I6b99e9a7102b3dcb6a7699f54b6456eba6248699 Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>
* Rename JSCall to JSCallDataLars Knoll2017-11-071-1/+1
| | | | | | | | As, this is going to change in a simple stack based structure to keep pointers to the data to pass to calls. Change-Id: Ia9aa3f81ee3eeba36affd16aac7b2fe97d59aea9 Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>
* Change CallData::argc to be a QV4::ValueErik Verbruggen2017-09-191-12/+12
| | | | | | | | | | | Instead of mimicking a Value. This makes sure that argc now stays correct even when anything on Value changes. Most of the change is mechanical: replace callData->argc by callData->argc(). Change-Id: I521831ae1ffb3966bad6589c18d7a373e13439d7 Reviewed-by: Lars Knoll <lars.knoll@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-02 01:35:37 +0000