cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/src/vm/interpret/intrinsic.rs

@@ -0,0 +1,350 @@
+//! Native versions of pure functions the script defines, such as the BLAKE3 compression its
+//! string decryption runs. A script function is replaced only after it returns the native
+//! result on test inputs. Calls with arguments a native version does not accept are
+//! interpreted.
+
+use std::ptr;
+
+use swc_core::ecma::ast::{Function, Lit};
+use swc_core::ecma::visit::{Visit, VisitWith};
+
+use super::copies::Copies;
+use super::run::Run;
+use crate::js;
+use crate::vm::HashMap;
+use crate::vm::session::Session;
+use crate::vm::value::{Callable, Value};
+
+/// A native function equivalent to a script function.
+#[derive(Clone, Copy)]
+pub(crate) enum Intrinsic {
+    /// `compress(cv, block, counter, length, flags)`: overwrites the 8 words of `cv` with the
+    /// BLAKE3 compression of the 16-word `block`.
+    Blake3Compress,
+}
+
+/// Script functions with native equivalents, by function address.
+pub(crate) type Intrinsics = HashMap<usize, Intrinsic>;
+
+/// The address identifying `function` in [`Intrinsics`].
+pub(super) fn address(function: &Function) -> usize {
+    ptr::from_ref(function).addr()
+}
+
+/// Finds the script functions `session` can run natively. Tests functions that take five
+/// parameters and mention the BLAKE3 initialization vector.
+pub(crate) fn intrinsics(session: &Session<'_>) -> Intrinsics {
+    session
+        .functions
+        .values()
+        .filter(|function| function.params.len() == 5 && mentions(function, IV[0]))
+        .filter(|function| compresses_like_native(session, function))
+        .map(|function| (address(function), Intrinsic::Blake3Compress))
+        .collect()
+}
+
+impl Intrinsic {
+    /// Runs the native version. Returns `None` if the arguments are outside what it reproduces
+    /// exactly, leaving the call to the interpreter.
+    pub(super) fn call<'ast>(self, arguments: &[Value<'ast>]) -> Option<Value<'ast>> {
+        match self {
+            Self::Blake3Compress => {
+                let [
+                    Value::Array(cv),
+                    Value::Array(block),
+                    counter,
+                    length,
+                    flags,
+                ] = arguments
+                else {
+                    return None;
+                };
+                let output = {
+                    let (cv, block) = (cv.borrow(), block.borrow());
+                    compress(
+                        &words(cv.get(..8)?)?,
+                        &words(block.get(..16)?)?,
+                        Counter::of(counter.as_number()?),
+                        js::int32(length.as_number()?) as u32,
+                        js::int32(flags.as_number()?) as u32,
+                    )
+                };
+                let mut cv = cv.borrow_mut();
+                for (slot, word) in cv.iter_mut().zip(output) {
+                    // The script stores the results of `^`, which are signed.
+                    *slot = Value::Number(f64::from(word as i32));
+                }
+                Some(Value::Undefined)
+            }
+        }
+    }
+}
+
+impl Value<'_> {
+    fn as_number(&self) -> Option<f64> {
+        match self {
+            Self::Number(number) => Some(*number),
+            _ => None,
+        }
+    }
+}
+
+/// Converts state or message words. The script first adds three words before truncating, which
+/// matches wrapping addition only while the sum is exact, so larger or fractional words are
+/// rejected.
+fn words<const N: usize>(values: &[Value<'_>]) -> Option<[u32; N]> {
+    let mut words = [0; N];
+    for (word, value) in words.iter_mut().zip(values) {
+        let number = value.as_number()?;
+        if number.fract() != 0.0 || number.abs() >= 2f64.powi(51) {
+            return None;
+        }
+        *word = js::int32(number) as u32;
+    }
+    Some(words)
+}
+
+/// A block counter split as the script splits it: `counter | 0` and
+/// `counter / 4294967296 | 0`.
+#[derive(Clone, Copy)]
+struct Counter {
+    low: u32,
+    high: u32,
+}
+
+impl Counter {
+    fn of(counter: f64) -> Self {
+        Self {
+            low: js::int32(counter) as u32,
+            high: js::int32(counter / 4_294_967_296.0) as u32,
+        }
+    }
+}
+
+const IV: [u32; 8] = [
+    0x6a09_e667,
+    0xbb67_ae85,
+    0x3c6e_f372,
+    0xa54f_f53a,
+    0x510e_527f,
+    0x9b05_688c,
+    0x1f83_d9ab,
+    0x5be0_cd19,
+];
+
+/// Message word order of each round after the first, relative to the previous round.
+const PERMUTATION: [usize; 16] = [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8];
+
+/// The BLAKE3 compression function, truncated to the chaining value.
+fn compress(
+    cv: &[u32; 8],
+    block: &[u32; 16],
+    counter: Counter,
+    length: u32,
+    flags: u32,
+) -> [u32; 8] {
+    let mut state = [0; 16];
+    state[..8].copy_from_slice(cv);
+    state[8..12].copy_from_slice(&IV[..4]);
+    state[12..].copy_from_slice(&[counter.low, counter.high, length, flags]);
+    let mut message = *block;
+    for round in 0..7 {
+        if round > 0 {
+            message = PERMUTATION.map(|index| message[index]);
+        }
+        mix(&mut state, [0, 4, 8, 12], message[0], message[1]);
+        mix(&mut state, [1, 5, 9, 13], message[2], message[3]);
+        mix(&mut state, [2, 6, 10, 14], message[4], message[5]);
+        mix(&mut state, [3, 7, 11, 15], message[6], message[7]);
+        mix(&mut state, [0, 5, 10, 15], message[8], message[9]);
+        mix(&mut state, [1, 6, 11, 12], message[10], message[11]);
+        mix(&mut state, [2, 7, 8, 13], message[12], message[13]);
+        mix(&mut state, [3, 4, 9, 14], message[14], message[15]);
+    }
+    std::array::from_fn(|index| state[index] ^ state[index + 8])
+}
+
+/// The BLAKE3 quarter-round `G` on state words `a`, `b`, `c` and `d`.
+fn mix(state: &mut [u32; 16], [a, b, c, d]: [usize; 4], x: u32, y: u32) {
+    state[a] = state[a].wrapping_add(state[b]).wrapping_add(x);
+    state[d] = (state[d] ^ state[a]).rotate_right(16);
+    state[c] = state[c].wrapping_add(state[d]);
+    state[b] = (state[b] ^ state[c]).rotate_right(12);
+    state[a] = state[a].wrapping_add(state[b]).wrapping_add(y);
+    state[d] = (state[d] ^ state[a]).rotate_right(8);
+    state[c] = state[c].wrapping_add(state[d]);
+    state[b] = (state[b] ^ state[c]).rotate_right(7);
+}
+
+/// Whether `function` contains the numeric literal `number`.
+fn mentions(function: &Function, number: u32) -> bool {
+    struct Finder {
+        number: f64,
+        found: bool,
+    }
+
+    impl Visit for Finder {
+        fn visit_lit(&mut self, literal: &Lit) {
+            self.found |= matches!(literal, Lit::Num(found) if found.value == self.number);
+        }
+    }
+
+    let mut finder = Finder {
+        number: f64::from(number),
+        found: false,
+    };
+    function.visit_with(&mut finder);
+    finder.found
+}
+
+/// Whether interpreting `function` gives the result of [`Intrinsic::Blake3Compress`] on every
+/// test input, returning nothing and recording no effects.
+fn compresses_like_native<'ast>(session: &Session<'ast>, function: &'ast Function) -> bool {
+    TEST_INPUTS.iter().all(|input| {
+        let native = input.arguments();
+        if Intrinsic::Blake3Compress.call(&native).is_none() {
+            return false;
+        }
+        // Clones share the arrays, so `interpreted` shows what the script wrote.
+        let interpreted = input.arguments();
+        let mut run = Run::new(session, &[], Vec::new(), Some(Copies::default()));
+        let callable = Callable::Script {
+            name: None,
+            function,
+            scope: None,
+        };
+        let outcome = run.invoke(&callable, Value::Undefined, interpreted.clone());
+        let same = matches!(outcome, Ok(Value::Undefined))
+            && run.effects.is_empty()
+            && numbers(&interpreted[0]) == numbers(&native[0]);
+        for scope in run.scopes() {
+            scope.borrow_mut().variables.clear();
+        }
+        same
+    })
+}
+
+/// Arguments for [`Intrinsic::Blake3Compress`], covering signed and unsigned words and a counter
+/// above 32 bits.
+struct TestInput {
+    cv: [f64; 8],
+    block: [f64; 16],
+    counter: f64,
+    length: f64,
+    flags: f64,
+}
+
+const TEST_INPUTS: [TestInput; 2] = [
+    TestInput {
+        cv: [
+            3_144_134_277.0,
+            -1_521_486_534.0,
+            7.0,
+            4_294_967_295.0,
+            1_359_893_119.0,
+            0.0,
+            -1.0,
+            2_147_483_648.0,
+        ],
+        block: [
+            1.0,
+            2.0,
+            3.0,
+            255.0,
+            65_536.0,
+            -2.0,
+            1_779_033_703.0,
+            3_000_000_000.0,
+            12.0,
+            -2_147_483_648.0,
+            99.0,
+            100_000.0,
+            31.0,
+            4_000_000_000.0,
+            5.0,
+            6.0,
+        ],
+        counter: 4_294_967_301.0,
+        length: 64.0,
+        flags: 11.0,
+    },
+    TestInput {
+        cv: [
+            1_779_033_703.0,
+            3_144_134_277.0,
+            1_013_904_242.0,
+            2_773_480_762.0,
+            1_359_893_119.0,
+            2_600_822_924.0,
+            528_734_635.0,
+            1_541_459_225.0,
+        ],
+        block: [
+            827_605_328.0,
+            17.0,
+            0.0,
+            0.0,
+            -5.0,
+            0.0,
+            0.0,
+            1_234.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+        ],
+        counter: 3.0,
+        length: 13.0,
+        flags: 1.0,
+    },
+];
+
+impl TestInput {
+    fn arguments<'ast>(&self) -> Vec<Value<'ast>> {
+        let array =
+            |numbers: &[f64]| Value::array(numbers.iter().copied().map(Value::Number).collect());
+        vec![
+            array(&self.cv),
+            array(&self.block),
+            Value::Number(self.counter),
+            Value::Number(self.length),
+            Value::Number(self.flags),
+        ]
+    }
+}
+
+fn numbers(value: &Value<'_>) -> Option<Vec<f64>> {
+    let Value::Array(elements) = value else {
+        return None;
+    };
+    elements.borrow().iter().map(Value::as_number).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// BLAKE3 of the empty input is one compression of an empty block with the chunk-start,
+    /// chunk-end and root flags.
+    #[test]
+    fn compresses_like_blake3() {
+        let digest = compress(&IV, &[0; 16], Counter::of(0.0), 0, 1 | 2 | 8);
+        let bytes: Vec<u8> = digest.iter().flat_map(|word| word.to_le_bytes()).collect();
+        let hex: String = bytes.iter().map(|byte| format!("{byte:02x}")).collect();
+        assert_eq!(
+            hex,
+            "af1349b9f5f9a1a6a0404dea36dcc9499bcb25c9adc112b7cc9a93cae41f3262"
+        );
+    }
+
+    #[test]
+    fn rejects_inexact_words() {
+        let mut arguments = TEST_INPUTS[0].arguments();
+        arguments[1] = Value::array(vec![Value::Number(0.5); 16]);
+        assert!(Intrinsic::Blake3Compress.call(&arguments).is_none());
+    }
+}

data/vendor/cfsolve/src/vm/interpret/plan.rs

@@ -1,6 +1,7 @@
 //! Compiles JavaScript into plans run by [`super::evaluate`]. Slot plans store function locals
-//! in numbered slots and cannot support closures capturing those locals. Scoped plans resolve
-//! names through scopes. Unsupported syntax becomes a node that stops evaluation if reached.
+//! in numbered slots, except locals that nested functions mention, which stay in the call's
+//! scope for those functions to capture. Scoped plans resolve all names through scopes.
+//! Unsupported syntax becomes a node that stops evaluation if reached.
 
 #[cfg(test)]
 use std::cell::Cell;
@@ -8,15 +9,17 @@ use std::cell::RefCell;
 use std::ptr;
 use std::rc::Rc;
 
+use rustc_hash::FxHashSet as HashSet;
 use swc_core::atoms::{Atom, atom};
 use swc_core::ecma::ast::{
-    ArrowExpr, AssignTarget, BinaryOp, BlockStmtOrExpr, Callee, CatchClause, Class, Decl,
-    DoWhileStmt, Expr, ExprOrSpread, FnDecl, Function, Ident, Lit, MemberExpr, MemberProp, Pat,
-    Prop, PropName, PropOrSpread, SimpleAssignTarget, Stmt, UnaryOp, UpdateOp, VarDecl,
+    ArrowExpr, AssignTarget, BinaryOp, BlockStmt, BlockStmtOrExpr, Callee, CatchClause, Class,
+    Decl, DoWhileStmt, Expr, ExprOrSpread, FnDecl, Function, Ident, Lit, MemberExpr, MemberProp,
+    Pat, Prop, PropName, PropOrSpread, SimpleAssignTarget, Stmt, UnaryOp, UpdateOp, VarDecl,
     VarDeclKind, VarDeclOrExpr, VarDeclarator, WhileStmt,
 };
 use swc_core::ecma::visit::{Visit, VisitWith};
 
+use super::compile::{self, Code};
 use super::semantics;
 use crate::vm::HashMap;
 use crate::vm::value::Value;
@@ -65,28 +68,35 @@ impl<'ast> Plans<'ast> {
 }
 
 pub(super) struct FunctionPlan<'ast> {
-    pub(super) parameters: Vec<usize>,
+    /// Where each parameter is bound: a slot, or the call's scope if a nested function
+    /// mentions it.
+    pub(super) parameters: Vec<Name<'ast>>,
     /// The slot of `arguments`, if the body reads it.
     pub(super) arguments: Option<usize>,
     pub(super) locals: usize,
-    pub(super) body: Vec<Statement<'ast>>,
+    /// The body, compiled into closures.
+    pub(super) code: Vec<Code<'ast>>,
 }
 
 impl<'ast> FunctionPlan<'ast> {
     /// Attempts to compile a slot plan. Returns `None` to request a scoped plan for unsupported
     /// syntax, parenthesized callees, computed object keys, logical assignments, parameter
-    /// patterns, variables named `arguments`, or nested functions capturing locals.
+    /// patterns, variables named `arguments`, or arrows reading `arguments`.
     pub(super) fn compile(function: &'ast Function) -> Option<Self> {
-        let mut compiler = PlanCompiler::default();
+        let body = function.body.as_ref()?;
+        let mut compiler = PlanCompiler {
+            captured: captured(body),
+            ..PlanCompiler::default()
+        };
         let mut parameters = Vec::with_capacity(function.params.len());
         for parameter in &function.params {
             let name = &parameter.pat.as_ident()?.sym;
             if name == "arguments" {
                 return None;
             }
-            parameters.push(compiler.slot(name));
+            compiler.local(name);
+            parameters.push(compiler.name(name));
         }
-        let body = function.body.as_ref()?;
         body.visit_with(&mut compiler);
         let body = compiler.body(&body.stmts);
         if compiler.rejected {
@@ -96,7 +106,7 @@ impl<'ast> FunctionPlan<'ast> {
             parameters,
             arguments: compiler.locals.get(&atom!("arguments")).copied(),
             locals: compiler.locals.len(),
-            body,
+            code: compile::statements(&body),
         })
     }
 }
@@ -126,6 +136,8 @@ pub(super) fn scoped_arrow(arrow: &ArrowExpr) -> Vec<Statement<'_>> {
 struct PlanCompiler {
     /// Slots of a slot plan's locals; empty for scoped plans.
     locals: HashMap<Atom, usize>,
+    /// Names nested functions mention. Locals with these names stay in the call's scope.
+    captured: HashSet<Atom>,
     /// Whether compilation needs a scoped plan. Ignored when compiling scoped plans.
     rejected: bool,
 }
@@ -133,32 +145,31 @@ struct PlanCompiler {
 impl Visit for PlanCompiler {
     fn visit_var_declarator(&mut self, declaration: &VarDeclarator) {
         if let Pat::Ident(name) = &declaration.name {
-            self.slot(&name.sym);
+            self.local(&name.sym);
         }
         declaration.visit_children_with(self);
     }
 
     fn visit_ident(&mut self, name: &Ident) {
         if name.sym == "arguments" {
-            self.slot(&name.sym);
+            self.local(&name.sym);
         }
     }
 
     /// Treat a nested function declaration as a local binding in the enclosing function.
     fn visit_fn_decl(&mut self, declaration: &FnDecl) {
-        self.slot(&declaration.ident.sym);
+        self.local(&declaration.ident.sym);
     }
 
     /// Treat a `catch` parameter as a function local in the execution plan.
     fn visit_catch_clause(&mut self, clause: &CatchClause) {
         if let Some(Pat::Ident(name)) = &clause.param {
-            self.slot(&name.sym);
+            self.local(&name.sym);
         }
         clause.visit_children_with(self);
     }
 
-    // Compile a nested function only if it captures no outer locals (see
-    // [`PlanCompiler::closes_over_nothing`]). Its own locals remain separate.
+    // A nested function's own locals remain separate.
     fn visit_function(&mut self, _: &Function) {}
     fn visit_arrow_expr(&mut self, _: &ArrowExpr) {}
     fn visit_class(&mut self, _: &Class) {}
@@ -166,12 +177,36 @@ impl Visit for PlanCompiler {
 
 /// Every name a nested function mentions, at any depth.
 #[derive(Default)]
-struct Names(Vec<Atom>);
+struct Names(HashSet<Atom>);
 
 impl Visit for Names {
     fn visit_ident(&mut self, name: &Ident) {
-        self.0.push(name.sym.clone());
+        self.0.insert(name.sym.clone());
+    }
+}
+
+/// The names that functions, arrows, and classes nested in `body` mention, except `arguments`,
+/// which functions shadow and arrows reading it are rejected for.
+fn captured(body: &BlockStmt) -> HashSet<Atom> {
+    struct Nested(Names);
+
+    impl Visit for Nested {
+        fn visit_function(&mut self, function: &Function) {
+            function.visit_with(&mut self.0);
+        }
+        fn visit_arrow_expr(&mut self, arrow: &ArrowExpr) {
+            arrow.visit_with(&mut self.0);
+        }
+        fn visit_class(&mut self, class: &Class) {
+            class.visit_with(&mut self.0);
+        }
     }
+
+    let mut nested = Nested(Names::default());
+    body.visit_with(&mut nested);
+    let Nested(Names(mut names)) = nested;
+    names.remove(&atom!("arguments"));
+    names
 }
 
 pub(super) struct Case<'ast> {
@@ -291,31 +326,22 @@ impl<'ast> Name<'ast> {
 }
 
 impl PlanCompiler {
-    fn slot(&mut self, name: &Atom) -> usize {
-        let next = self.locals.len();
-        *self.locals.entry(name.clone()).or_insert(next)
-    }
-
-    /// Checks that a nested function captures no locals from the function being compiled.
-    /// Slot plans do not put these locals in the scope chain. Ordinary functions shadow
-    /// `arguments`; arrows inherit it and must not read it.
-    fn closes_over_nothing(&self, nested: &impl VisitWith<Names>, arrow: bool) -> bool {
-        let mut names = Names::default();
-        nested.visit_with(&mut names);
-        names
-            .0
-            .iter()
-            .all(|name| !self.locals.contains_key(name) && !(arrow && name == "arguments"))
+    /// Gives local `name` a slot unless a nested function mentions it.
+    fn local(&mut self, name: &Atom) {
+        if !self.captured.contains(name) {
+            let next = self.locals.len();
+            self.locals.entry(name.clone()).or_insert(next);
+        }
     }
 
-    /// Plans a function body, binding function declarations before executing statements.
-    /// Declarations beside the VM class are planned as statements and resolved as globals.
+    /// Plans a function body or block, binding its function declarations before executing
+    /// statements, as JavaScript hoists them to the start of the body or block. Declarations
+    /// beside the VM class are planned as statements and resolved as globals.
     fn body<'a>(&mut self, statements: &'a [Stmt]) -> Vec<Statement<'a>> {
         let mut plan = Vec::with_capacity(statements.len());
         for statement in statements {
             if let Stmt::Decl(Decl::Fn(declaration)) = statement {
                 let name = &declaration.ident.sym;
-                self.rejected |= !self.closes_over_nothing(&*declaration.function, false);
                 plan.push(Statement::Declare(vec![Declaration {
                     name: self.name(name),
                     init: Some(Expression::Function(Some(name), &declaration.function)),
@@ -341,7 +367,6 @@ impl PlanCompiler {
             // Declarations do not bind their names; the names resolve as globals.
             Stmt::Decl(Decl::Fn(_) | Decl::Class(_)) | Stmt::Empty(_) => Statement::Empty,
             Stmt::Decl(_) => Statement::Expression(self.unsupported("a declaration")),
-            // A block shares its function's scope, so its function declarations bind at its start.
             Stmt::Block(block) => Statement::Block(self.body(&block.stmts)),
             Stmt::If(branch) => Statement::If(
                 self.expression(&branch.test),
@@ -406,13 +431,13 @@ impl PlanCompiler {
                     }
                 };
                 Statement::Try {
-                    block: self.statements(&attempt.block.stmts),
+                    block: self.body(&attempt.block.stmts),
                     parameter,
-                    handler: handler.map(|handler| self.statements(&handler.body.stmts)),
+                    handler: handler.map(|handler| self.body(&handler.body.stmts)),
                     finalizer: attempt
                         .finalizer
                         .as_ref()
-                        .map(|body| self.statements(&body.stmts)),
+                        .map(|body| self.body(&body.stmts)),
                 }
             }
             Stmt::ForIn(_) | Stmt::ForOf(_) => {
@@ -665,12 +690,14 @@ impl PlanCompiler {
                     .collect(),
             ),
             Expr::Fn(function) => {
-                self.rejected |= !self.closes_over_nothing(&function.function, false);
                 let name = function.ident.as_ref().map(|ident| &ident.sym);
                 Expression::Function(name, &function.function)
             }
+            // Arrows inherit `arguments`, which slot plans keep out of scopes.
             Expr::Arrow(arrow) => {
-                self.rejected |= !self.closes_over_nothing(arrow, true);
+                let mut names = Names::default();
+                arrow.visit_with(&mut names);
+                self.rejected |= names.0.contains(&atom!("arguments"));
                 Expression::Arrow(arrow)
             }
             expression => self.unsupported(match expression {