JS: Check for errors before using sub-expression results

Specifically: don't de-reference a result and assume that it's not-null.

Task-number: QTBUG-54687
Change-Id: If07d3250a95a7815ab7a3262b88e0227965ef8e7
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

1 files changed, 95 insertions, 21 deletions

diff --git a/src/qml/compiler/qv4codegen.cpp b/src/qml/compiler/qv4codegen.cpp
index c14163a2f7..6bf931c882 100644
--- a/src/qml/compiler/qv4codegen.cpp
+++ b/src/qml/compiler/qv4codegen.cpp
@@ -1052,6 +1052,8 @@ bool Codegen::visit(ArrayLiteral *ast)
             current->expr = _block->CONST(IR::MissingType, 0);
         }
         Result expr = expression(it->expression);
+        if (hasError)
+            return false;
 
         IR::ExprList *arg = _function->New<IR::ExprList>();
         if (!current) {
@@ -1094,6 +1096,8 @@ bool Codegen::visit(ArrayMemberExpression *ast)
 
     Result base = expression(ast->base);
     Result index = expression(ast->expression);
+    if (hasError)
+        return false;
     _expr.code = subscript(*base, *index);
     return false;
 }
@@ -1133,10 +1137,16 @@ bool Codegen::visit(BinaryExpression *ast)
 
             const unsigned r = _block->newTemp();
 
-            move(_block->TEMP(r), *expression(ast->left));
+            Result lhs = expression(ast->left);
+            if (hasError)
+                return false;
+            move(_block->TEMP(r), *lhs);
             setLocation(cjump(_block->TEMP(r), iftrue, endif), ast->operatorToken);
             _block = iftrue;
-            move(_block->TEMP(r), *expression(ast->right));
+            Result rhs = expression(ast->right);
+            if (hasError)
+                return false;
+            move(_block->TEMP(r), *rhs);
             _block->JUMP(endif);
 
             _expr.code = _block->TEMP(r);
@@ -1154,10 +1164,16 @@ bool Codegen::visit(BinaryExpression *ast)
             IR::BasicBlock *endif = _function->newBasicBlock(exceptionHandler());
 
             const unsigned r = _block->newTemp();
-            move(_block->TEMP(r), *expression(ast->left));
+            Result lhs = expression(ast->left);
+            if (hasError)
+                return false;
+            move(_block->TEMP(r), *lhs);
             setLocation(cjump(_block->TEMP(r), endif, iffalse), ast->operatorToken);
             _block = iffalse;
-            move(_block->TEMP(r), *expression(ast->right));
+            Result rhs = expression(ast->right);
+            if (hasError)
+                return false;
+            move(_block->TEMP(r), *rhs);
             _block->JUMP(endif);
 
             _block = endif;
@@ -1167,6 +1183,8 @@ bool Codegen::visit(BinaryExpression *ast)
     }
 
     IR::Expr* left = *expression(ast->left);
+    if (hasError)
+        return false;
 
     switch (ast->op) {
     case QSOperator::Or:
@@ -1176,17 +1194,19 @@ bool Codegen::visit(BinaryExpression *ast)
     case QSOperator::Assign: {
         if (throwSyntaxErrorOnEvalOrArgumentsInStrictMode(left, ast->left->lastSourceLocation()))
             return false;
-        IR::Expr* right = *expression(ast->right);
+        Result right = expression(ast->right);
+        if (hasError)
+            return false;
         if (!left->isLValue()) {
             throwReferenceError(ast->operatorToken, QStringLiteral("left-hand side of assignment operator is not an lvalue"));
             return false;
         }
 
         if (_expr.accept(nx)) {
-            move(left, right);
+            move(left, *right);
         } else {
             const unsigned t = _block->newTemp();
-            move(_block->TEMP(t), right);
+            move(_block->TEMP(t), *right);
             move(left, _block->TEMP(t));
             _expr.code = _block->TEMP(t);
         }
@@ -1206,17 +1226,19 @@ bool Codegen::visit(BinaryExpression *ast)
     case QSOperator::InplaceXor: {
         if (throwSyntaxErrorOnEvalOrArgumentsInStrictMode(left, ast->left->lastSourceLocation()))
             return false;
-        IR::Expr* right = *expression(ast->right);
+        Result right = expression(ast->right);
+        if (hasError)
+            return false;
         if (!left->isLValue()) {
             throwSyntaxError(ast->operatorToken, QStringLiteral("left-hand side of inplace operator is not an lvalue"));
             return false;
         }
 
         if (_expr.accept(nx)) {
-            move(left, right, baseOp(ast->op));
+            move(left, *right, baseOp(ast->op));
         } else {
             const unsigned t = _block->newTemp();
-            move(_block->TEMP(t), right);
+            move(_block->TEMP(t), *right);
             move(left, _block->TEMP(t), baseOp(ast->op));
             _expr.code = left;
         }
@@ -1239,12 +1261,14 @@ bool Codegen::visit(BinaryExpression *ast)
             left = _block->TEMP(t);
         }
 
-        IR::Expr* right = *expression(ast->right);
+        Result right = expression(ast->right);
+        if (hasError)
+            return false;
 
         if (_expr.accept(cx)) {
-            setLocation(cjump(binop(IR::binaryOperator(ast->op), left, right, ast->operatorToken), _expr.iftrue, _expr.iffalse), ast->operatorToken);
+            setLocation(cjump(binop(IR::binaryOperator(ast->op), left, *right, ast->operatorToken), _expr.iftrue, _expr.iffalse), ast->operatorToken);
         } else {
-            IR::Expr *e = binop(IR::binaryOperator(ast->op), left, right, ast->operatorToken);
+            IR::Expr *e = binop(IR::binaryOperator(ast->op), left, *right, ast->operatorToken);
             if (e->asConst() || e->asString())
                 _expr.code = e;
             else {
@@ -1273,9 +1297,11 @@ bool Codegen::visit(BinaryExpression *ast)
             left = _block->TEMP(t);
         }
 
-        IR::Expr* right = *expression(ast->right);
+        Result right = expression(ast->right);
+        if (hasError)
+            return false;
 
-        IR::Expr *e = binop(IR::binaryOperator(ast->op), left, right, ast->operatorToken);
+        IR::Expr *e = binop(IR::binaryOperator(ast->op), left, *right, ast->operatorToken);
         if (e->asConst() || e->asString())
             _expr.code = e;
         else {
@@ -1300,11 +1326,15 @@ bool Codegen::visit(CallExpression *ast)
     IR::ExprList *args = 0, **args_it = &args;
     for (ArgumentList *it = ast->arguments; it; it = it->next) {
         Result arg = expression(it->expression);
+        if (hasError)
+            return false;
         IR::Expr *actual = argument(*arg);
         *args_it = _function->New<IR::ExprList>();
         (*args_it)->init(actual);
         args_it = &(*args_it)->next;
     }
+    if (hasError)
+        return false;
     _expr.code = call(*base, args);
     return false;
 }
@@ -1323,11 +1353,17 @@ bool Codegen::visit(ConditionalExpression *ast)
     condition(ast->expression, iftrue, iffalse);
 
     _block = iftrue;
-    move(_block->TEMP(t), *expression(ast->ok));
+    Result ok = expression(ast->ok);
+    if (hasError)
+        return false;
+    move(_block->TEMP(t), *ok);
     _block->JUMP(endif);
 
     _block = iffalse;
-    move(_block->TEMP(t), *expression(ast->ko));
+    Result ko = expression(ast->ko);
+    if (hasError)
+        return false;
+    move(_block->TEMP(t), *ko);
     _block->JUMP(endif);
 
     _block = endif;
@@ -1343,6 +1379,8 @@ bool Codegen::visit(DeleteExpression *ast)
         return false;
 
     IR::Expr* expr = *expression(ast->expression);
+    if (hasError)
+        return false;
     // Temporaries cannot be deleted
     IR::ArgLocal *al = expr->asArgLocal();
     if (al && al->index < static_cast<unsigned>(_env->members.size())) {
@@ -1404,7 +1442,8 @@ bool Codegen::visit(FieldMemberExpression *ast)
         return false;
 
     Result base = expression(ast->base);
-    _expr.code = member(*base, _function->newString(ast->name.toString()));
+    if (!hasError)
+        _expr.code = member(*base, _function->newString(ast->name.toString()));
     return false;
 }
 
@@ -1495,6 +1534,8 @@ bool Codegen::visit(NewExpression *ast)
         return false;
 
     Result base = expression(ast->expression);
+    if (hasError)
+        return false;
     IR::Expr *expr = *base;
     if (expr && !expr->asTemp() && !expr->asArgLocal() && !expr->asName() && !expr->asMember()) {
         const unsigned t = _block->newTemp();
@@ -1511,6 +1552,8 @@ bool Codegen::visit(NewMemberExpression *ast)
         return false;
 
     Result base = expression(ast->base);
+    if (hasError)
+        return false;
     IR::Expr *expr = *base;
     if (expr && !expr->asTemp() && !expr->asArgLocal() && !expr->asName() && !expr->asMember()) {
         const unsigned t = _block->newTemp();
@@ -1521,6 +1564,8 @@ bool Codegen::visit(NewMemberExpression *ast)
     IR::ExprList *args = 0, **args_it = &args;
     for (ArgumentList *it = ast->arguments; it; it = it->next) {
         Result arg = expression(it->expression);
+        if (hasError)
+            return false;
         IR::Expr *actual = argument(*arg);
         *args_it = _function->New<IR::ExprList>();
         (*args_it)->init(actual);
@@ -1538,6 +1583,8 @@ bool Codegen::visit(NotExpression *ast)
         return false;
 
     Result expr = expression(ast->expression);
+    if (hasError)
+        return false;
     const unsigned r = _block->newTemp();
     setLocation(move(_block->TEMP(r), unop(IR::OpNot, *expr, ast->notToken)), ast->notToken);
     _expr.code = _block->TEMP(r);
@@ -1595,6 +1642,8 @@ bool Codegen::visit(ObjectLiteral *ast)
         QString name = it->assignment->name->asString();
         if (PropertyNameAndValue *nv = AST::cast<AST::PropertyNameAndValue *>(it->assignment)) {
             Result value = expression(nv->value);
+            if (hasError)
+                return false;
             ObjectPropertyValue &v = valueMap[name];
             if (v.hasGetter() || v.hasSetter() || (_function->isStrict && v.value)) {
                 throwSyntaxError(nv->lastSourceLocation(),
@@ -1725,6 +1774,8 @@ bool Codegen::visit(PostDecrementExpression *ast)
         return false;
 
     Result expr = expression(ast->base);
+    if (hasError)
+        return false;
     if (!expr->isLValue()) {
         throwReferenceError(ast->base->lastSourceLocation(), QStringLiteral("Invalid left-hand side expression in postfix operation"));
         return false;
@@ -1751,6 +1802,8 @@ bool Codegen::visit(PostIncrementExpression *ast)
         return false;
 
     Result expr = expression(ast->base);
+    if (hasError)
+        return false;
     if (!expr->isLValue()) {
         throwReferenceError(ast->base->lastSourceLocation(), QStringLiteral("Invalid left-hand side expression in postfix operation"));
         return false;
@@ -1777,6 +1830,8 @@ bool Codegen::visit(PreDecrementExpression *ast)
         return false;
 
     Result expr = expression(ast->expression);
+    if (hasError)
+        return false;
     if (!expr->isLValue()) {
         throwReferenceError(ast->expression->lastSourceLocation(), QStringLiteral("Prefix ++ operator applied to value that is not a reference."));
         return false;
@@ -1802,6 +1857,8 @@ bool Codegen::visit(PreIncrementExpression *ast)
         return false;
 
     Result expr = expression(ast->expression);
+    if (hasError)
+        return false;
     if (!expr->isLValue()) {
         throwReferenceError(ast->expression->lastSourceLocation(), QStringLiteral("Prefix ++ operator applied to value that is not a reference."));
         return false;
@@ -1854,6 +1911,8 @@ bool Codegen::visit(TildeExpression *ast)
         return false;
 
     Result expr = expression(ast->expression);
+    if (hasError)
+        return false;
     const unsigned t = _block->newTemp();
     setLocation(move(_block->TEMP(t), unop(IR::OpCompl, *expr, ast->tildeToken)), ast->tildeToken);
     _expr.code = _block->TEMP(t);
@@ -1879,6 +1938,8 @@ bool Codegen::visit(TypeOfExpression *ast)
         return false;
 
     Result expr = expression(ast->expression);
+    if (hasError)
+        return false;
     IR::ExprList *args = _function->New<IR::ExprList>();
     args->init(reference(*expr));
     _expr.code = call(_block->NAME(IR::Name::builtin_typeof, ast->typeofToken.startLine, ast->typeofToken.startColumn), args);
@@ -1891,6 +1952,8 @@ bool Codegen::visit(UnaryMinusExpression *ast)
         return false;
 
     Result expr = expression(ast->expression);
+    if (hasError)
+        return false;
     const unsigned t = _block->newTemp();
     setLocation(move(_block->TEMP(t), unop(IR::OpUMinus, *expr, ast->minusToken)), ast->minusToken);
     _expr.code = _block->TEMP(t);
@@ -1903,6 +1966,8 @@ bool Codegen::visit(UnaryPlusExpression *ast)
         return false;
 
     Result expr = expression(ast->expression);
+    if (hasError)
+        return false;
     const unsigned t = _block->newTemp();
     setLocation(move(_block->TEMP(t), unop(IR::OpUPlus, *expr, ast->plusToken)), ast->plusToken);
     _expr.code = _block->TEMP(t);
@@ -2217,7 +2282,10 @@ bool Codegen::visit(ForEachStatement *ast)
     IR::BasicBlock *foreachend = _function->newBasicBlock(exceptionHandler());
 
     int objectToIterateOn = _block->newTemp();
-    move(_block->TEMP(objectToIterateOn), *expression(ast->expression));
+    Result expr = expression(ast->expression);
+    if (hasError)
+        return false;
+    move(_block->TEMP(objectToIterateOn), *expr);
     IR::ExprList *args = _function->New<IR::ExprList>();
     args->init(_block->TEMP(objectToIterateOn));
 
@@ -2229,7 +2297,10 @@ bool Codegen::visit(ForEachStatement *ast)
 
     _block = foreachbody;
     int temp = _block->newTemp();
-    move(*expression(ast->initialiser), _block->TEMP(temp));
+    Result init = expression(ast->initialiser);
+    if (hasError)
+        return false;
+    move(*init, _block->TEMP(temp));
     statement(ast->statement);
     _block->JUMP(foreachin);
 
@@ -2719,7 +2790,10 @@ bool Codegen::visit(WithStatement *ast)
     _function->hasWith = true;
 
     const int withObject = _block->newTemp();
-    _block->MOVE(_block->TEMP(withObject), *expression(ast->expression));
+    Result src = expression(ast->expression);
+    if (hasError)
+        return false;
+    _block->MOVE(_block->TEMP(withObject), *src);
 
     // need an exception handler for with to cleanup the with scope
     IR::BasicBlock *withExceptionHandler = _function->newBasicBlock(exceptionHandler());