@swf2es/player 0.0.0-stage → 0.1.0

package/src/scripting/evaluate.ts

@@ -0,0 +1,178 @@
+// How a module's source becomes its factory, under a script name of its
+// own that its code's stack frames give, by which Runtime.codeDomain and
+// Code.codeOrigin tell whose code runs.
+import { avm2 } from "@swf2es/runtime";
+import type { LazyCompiler } from "./lazy.js";
+
+type Value = avm2.Value;
+
+/** A module's factory, as it exports it: given the runtime, it loads the module into it. */
+export type Factory = (rt: avm2.Runtime, jit?: LazyCompiler) => Value;
+
+/** A module's factory and the script its code's frames name. */
+export interface Evaluated {
+  factory: Factory;
+  script: string;
+}
+
+const EXPORT = "export default ";
+
+/**
+ * A module's factory, its source evaluated by a strict Function under the
+ * sourceURL `script`. Not imported: a document keeps every module it
+ * imports for as long as it lives, so the code of a SWF long let go would
+ * never be collected; a Function's goes once nothing refers to its
+ * functions. A module is one exported function and nothing else, so it
+ * runs the same returned from a strict Function, the names its code uses
+ * its own function's variables (see Lazy compilation in
+ * docs/architecture/compiler.md); its lines in a stack are its file's two further
+ * on, after Function's header.
+ */
+export function evaluateFunction(module: string, script: string): Factory {
+  return new Function(`"use strict"; return ${body(module)}//# sourceURL=${script}\n`)();
+}
+
+/**
+ * A module's factory and the script its frames name: evaluated by a
+ * Function under the sourceURL `script` where the engine's frames name a
+ * Function's code by it, as V8's and SpiderMonkey's do; else, in a
+ * document, as a classic script from a Blob URL of its own, which the
+ * frames name. JavaScriptCore's frames name no script for a Function's
+ * code, whatever its sourceURL, so that without a script, as in a Worker,
+ * which has no document, or once one is refused, every SWF's code is
+ * taken for the host's: its domain the main SWF's, for currentDomain, a
+ * load's default domain and the rest. A classic script's code, unlike an
+ * imported module's, goes with the SWF, as a Function's does. Only a
+ * script waits, for its load.
+ */
+export function evaluate(module: string, script: string): Evaluated | Promise<Evaluated> {
+  if (framesNameFunctions() || scripts === "refused" || typeof document === "undefined") {
+    return { factory: evaluateFunction(module, script), script };
+  }
+
+  // Until one has run, one script at a time: a policy that refuses them
+  // then reports one refusal, not one for each module of the first SWF.
+  if (trial) {
+    return trial.then(() => evaluate(module, script));
+  }
+
+  const evaluated = viaScript(module, script);
+  if (scripts === "untried") {
+    trial = evaluated.then(
+      () => {
+        trial = null;
+      },
+      () => {
+        trial = null;
+      },
+    );
+  }
+
+  return evaluated;
+}
+
+/**
+ * The module as a script, or, if the script did not run, by a Function:
+ * its error, if it has one, is the source's, which a script would give
+ * only to the page's onerror, and the scripts are left to be tried again;
+ * if the Function evaluates, scripts are what failed (refused by a
+ * Content-Security-Policy without blob: in script-src or by Trusted Types,
+ * never loaded, or loaded but not run, as by a DOM that runs none), and
+ * every module after is evaluated by a Function.
+ */
+async function viaScript(module: string, script: string): Promise<Evaluated> {
+  const ran = await evaluateScript(module);
+  if (ran) {
+    scripts = "allowed";
+    return ran;
+  }
+
+  const factory = evaluateFunction(module, script);
+  scripts = "refused";
+  return { factory, script };
+}
+
+function body(module: string): string {
+  if (!module.startsWith(EXPORT)) {
+    throw new Error("swf2es: a module that is not one exported function");
+  }
+
+  return module.slice(EXPORT.length);
+}
+
+const PROBE = "swf2es-probe.js";
+let functionsNamed: boolean | undefined;
+
+/**
+ * Whether the engine's frames name a Function's code by its sourceURL,
+ * asked of a Function once. One that cannot be made (a policy without
+ * 'unsafe-eval') leaves the modules to be evaluated by Function, refused
+ * as before, only imported ones loading.
+ */
+function framesNameFunctions(): boolean {
+  if (functionsNamed === undefined) {
+    try {
+      const stack = new Function(
+        `"use strict"; return new Error().stack\n//# sourceURL=${PROBE}\n`,
+      )();
+      functionsNamed = avm2.frameScripts(stack).includes(PROBE);
+    } catch {
+      functionsNamed = true;
+    }
+  }
+
+  return functionsNamed;
+}
+
+/** Whether modules' scripts have run, or failed to where a Function did not. */
+let scripts: "untried" | "allowed" | "refused" = "untried";
+/** The first script while it settles, which the others wait for. */
+let trial: Promise<void> | null = null;
+
+/** The property of its script element a module's script leaves its factory on. */
+const FACTORY = "swf2esFactory";
+
+/** How long a module's script may take to load and run, from a Blob URL. */
+const SCRIPT_TIMEOUT = 5000;
+
+/**
+ * A module's factory, its source evaluated as a classic script from a Blob
+ * URL, and that URL; null if the script did not run: refused, as setting
+ * its src may be (Trusted Types), failed, or not loaded in time, or loaded
+ * without a factory, as a source that does not parse is. The element and
+ * the URL are let go at once: the frames still name the URL, and nothing
+ * else keeps the code but its functions.
+ */
+async function evaluateScript(module: string): Promise<Evaluated | null> {
+  const source = `"use strict";document.currentScript.${FACTORY}=${body(module)}\n`;
+  const url = URL.createObjectURL(new Blob([source], { type: "text/javascript" }));
+  const script = document.createElement("script") as HTMLScriptElement & {
+    [FACTORY]?: unknown;
+  };
+  let loaded: boolean;
+  try {
+    loaded = await new Promise<boolean>((done) => {
+      const timer = setTimeout(() => done(false), SCRIPT_TIMEOUT);
+      const settle = (ok: boolean) => {
+        clearTimeout(timer);
+        done(ok);
+      };
+      script.onload = () => settle(true);
+      script.onerror = () => settle(false);
+      try {
+        script.src = url;
+        (document.head ?? document.documentElement).append(script);
+      } catch {
+        settle(false);
+      }
+    });
+  } finally {
+    script.remove();
+    URL.revokeObjectURL(url);
+  }
+
+  const factory = script[FACTORY];
+  return loaded && typeof factory === "function"
+    ? { factory: factory as Factory, script: url }
+    : null;
+}

package/src/scripting/events.ts

@@ -0,0 +1,236 @@
+// Event dispatch, as Flash's: along a display object's parent chain,
+// capture, target, bubble, to the listeners EventDispatcher keeps on each
+// AS3 object; or to one object's own, as a broadcast reaches it. The
+// player's input and frame events and playerglobal's dispatchEvent all
+// go through it.
+import { avm2 } from "@swf2es/runtime";
+import type { Scripting } from "../scripting.js";
+
+type AsObject = avm2.AsObject;
+type Value = avm2.Value;
+
+export const CAPTURING_PHASE = 1;
+export const AT_TARGET = 2;
+export const BUBBLING_PHASE = 3;
+
+export interface Listener {
+  fn: Value;
+  capture: boolean;
+  priority: number;
+}
+
+/**
+ * Where an event keeps what dispatch reads and writes, by field: the slots
+ * of playerglobal's AS3 fields (as3/playerglobal/src/flash/events/Event.as),
+ * which compiled code reads directly, or under Flash Player's playerglobal
+ * the fields its natives keep (playerglobal/flash/events/Event.ts).
+ */
+export interface EventFields {
+  type: string;
+  bubbles: string;
+  target: string;
+  currentTarget: string;
+  phase: string;
+  /** 0 propagating, 1 stopped after the current object, 2 stopped at once. */
+  stopped: string;
+  prevented: string;
+}
+
+/** The fields of `s`'s events, found once playerglobal is loaded. */
+export function eventFields(s: Scripting): EventFields {
+  if (s.eventFields) {
+    return s.eventFields;
+  }
+
+  const cls = s.rt.classNamed("flash.events::Event");
+  const field = (as3: string, native: string) => avm2.instanceVarField(cls, as3) ?? native;
+  s.eventFields = {
+    type: field("_type", "$type"),
+    bubbles: field("_bubbles", "$bubbles"),
+    target: field("_target", "$target"),
+    currentTarget: field("_currentTarget", "$currentTarget"),
+    phase: field("_eventPhase", "$phase"),
+    stopped: field("_stopped", "$stopped"),
+    prevented: field("_prevented", "$prevented"),
+  };
+  return s.eventFields;
+}
+
+/** The display object `o` is the face of, if it is one. */
+export const displayOf = (o: AsObject) => o.$display ?? null;
+
+// A listener's error is reported as uncaught, and the listeners after it
+// still run: it never reaches the dispatcher, a script's dispatchEvent
+// included, which returns as if none had thrown (as in Flash and Ruffle).
+// `current` is `o` but where `o` stands in for another dispatcher, which
+// its listeners see as the current target, as in Flash.
+function invoke(
+  s: Scripting,
+  f: EventFields,
+  o: AsObject,
+  event: AsObject,
+  phase: number,
+  current: AsObject = o,
+): void {
+  const list = o.$listeners?.get(event[f.type]) as Listener[] | undefined;
+  if (!list) {
+    return;
+  }
+
+  event[f.currentTarget] = current;
+  event[f.phase] = phase;
+  // A copy: a listener may add or remove listeners. Not of one alone, read before it is called,
+  // which nothing it does could add to or take from what this dispatch calls: each frame's
+  // events reach thousands of objects so.
+  const listeners = list.length === 1 ? list : [...list];
+  const count = listeners.length;
+  for (let i = 0; i < count; i++) {
+    const l = listeners[i];
+    if (l.capture !== (phase === CAPTURING_PHASE)) {
+      continue;
+    }
+
+    try {
+      s.rt.call(l.fn, null, event);
+    } catch (error) {
+      s.reportUncaught(error);
+    }
+
+    if (event[f.stopped] === 2) {
+      return;
+    }
+  }
+}
+
+/**
+ * Whether `target` or an object above it listens for `type`, in any phase.
+ * Where none does, dispatching an event of the type runs no script, so
+ * none could tell whether it was made: the player's own events, one for
+ * each object put on the list or taken off, are made only where heard.
+ */
+export function heard(target: AsObject, type: string): boolean {
+  if ((target.$listeners?.get(type) as Listener[] | undefined)?.length) {
+    return true;
+  }
+
+  for (let d = displayOf(target)?.parent; d; d = d.parent) {
+    if ((d.object?.$listeners?.get(type) as Listener[] | undefined)?.length) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/** Dispatch `event` to `target`'s own listeners only, as a broadcast reaches each object: no capture, no bubble. */
+export function dispatchTo(s: Scripting, target: AsObject, event: AsObject): void {
+  const f = eventFields(s);
+  event[f.target] = target.$target ?? target;
+  invoke(s, f, target, event, AT_TARGET);
+}
+
+/**
+ * Give `event` to one of `target`'s listeners, `fn`, at the target: as AIR
+ * gives each InvokeEvent listener the application's launch once it listens.
+ */
+export function dispatchToListener(
+  s: Scripting,
+  target: AsObject,
+  event: AsObject,
+  fn: Value,
+): void {
+  const f = eventFields(s);
+  event[f.target] = target.$target ?? target;
+  event[f.currentTarget] = target;
+  event[f.phase] = AT_TARGET;
+  try {
+    s.rt.call(fn, null, event);
+  } catch (error) {
+    s.reportUncaught(error);
+  }
+}
+
+/**
+ * Dispatch `event` from `target`, as EventDispatcher.dispatchEvent does; whether no listener
+ * prevented its default. A dispatcher that stands in for another, an
+ * EventDispatcher made with a target, dispatches as that one, along its
+ * parent chain, with its own listeners at the target.
+ */
+export function dispatchEvent(s: Scripting, target: AsObject, event: AsObject): boolean {
+  const f = eventFields(s);
+  const owner: AsObject = target.$target ?? target;
+  event[f.target] = owner;
+  // The ancestors of a display object, nearest first.
+  const ancestors: AsObject[] = [];
+  for (let d = displayOf(owner)?.parent; d; d = d.parent) {
+    if (d.object) {
+      ancestors.push(d.object);
+    }
+  }
+
+  for (let i = ancestors.length - 1; i >= 0 && event[f.stopped] === 0; i--) {
+    invoke(s, f, ancestors[i], event, CAPTURING_PHASE);
+  }
+
+  if (event[f.stopped] === 0) {
+    invoke(s, f, target, event, AT_TARGET, owner);
+  }
+
+  if (event[f.bubbles]) {
+    for (const a of ancestors) {
+      if (event[f.stopped] !== 0) {
+        break;
+      }
+
+      invoke(s, f, a, event, BUBBLING_PHASE);
+    }
+  }
+
+  return !event[f.prevented];
+}
+
+/**
+ * Broadcast targets held weakly, in the order first added: a listener for
+ * ACTIVATE or DEACTIVATE keeps no object alive, nor its timeline playing.
+ * One collected drops out as it goes.
+ */
+export class WeakTargets {
+  private readonly refs = new Set<WeakRef<AsObject>>();
+  private readonly byObject = new WeakMap<AsObject, WeakRef<AsObject>>();
+  private readonly collected = new FinalizationRegistry<WeakRef<AsObject>>((ref) =>
+    this.refs.delete(ref),
+  );
+
+  add(o: AsObject): void {
+    if (this.byObject.has(o)) {
+      return;
+    }
+
+    const ref = new WeakRef(o);
+    this.byObject.set(o, ref);
+    this.refs.add(ref);
+    this.collected.register(o, ref, ref);
+  }
+
+  delete(o: AsObject): void {
+    const ref = this.byObject.get(o);
+    if (ref) {
+      this.byObject.delete(o);
+      this.refs.delete(ref);
+      this.collected.unregister(ref);
+    }
+  }
+
+  /** Those still alive, in order, found first: a listener may add or remove others. */
+  live(): AsObject[] {
+    const live: AsObject[] = [];
+    for (const ref of this.refs) {
+      const o = ref.deref();
+      if (o) {
+        live.push(o);
+      }
+    }
+
+    return live;
+  }
+}

package/src/scripting/handover.ts

@@ -0,0 +1,253 @@
+// The primordial's compiled modules handed to its background workers
+// (docs/workers.md, slice 5), so that a worker running the same ABCs does
+// not compile them again: each Crossbridge thread is a worker, and a large
+// Crossbridge SWF takes minutes to compile.
+//
+// The compiler is deterministic: the same calls on a fresh one give the
+// same modules. So the primordial keeps a journal of every call that
+// changes what its compiler compiles to, with the module and log each
+// compile gave, until its main SWF has linked; a worker journals its own
+// calls the same way, and takes the primordial's module for a compile
+// only while its journal is the primordial's so far and its ABCs are the
+// same bytes. No key is taken: a key names the log, which a worker would
+// have to replay every module's for, and replaying verifies each method
+// again, half a compile. The logs are replayed only if the worker's
+// compiler is used again (a lazy method, a SWF it loads), before that use.
+import type { Codegen } from "@swf2es/codegen";
+
+/** A module the primordial compiled, read, or imported, and what compiling it fixed in the compiler's domain. */
+export interface HandedModule {
+  /** Its source, as a Blob where the host has them, which crosses to a thread without a copy. */
+  module?: Blob | string;
+  /** Where it was imported from, as a module compiled ahead of time is under a policy without 'unsafe-eval'. */
+  url?: string;
+  log: string;
+}
+
+/** What a worker is handed: the primordial's journal, its ABCs' hashes, and its modules, by the place of their compile in the journal. */
+export interface HandedModules {
+  ops: string[];
+  hashes: string[];
+  modules: [number, HandedModule][];
+}
+
+/** The primordial's journal, kept while it may hand its modules to workers. */
+export class ModuleRecorder {
+  private readonly ops: string[] = [];
+  private readonly modules = new Map<number, HandedModule>();
+  /** Where in the journal each ABC's module was last compiled, by its index. */
+  private readonly places = new Map<number, number>();
+  private epoch: number | null = null;
+  private frozen: HandedModules | null = null;
+  /** Whether calls are still journaled. */
+  open = true;
+
+  /** A call on the compiler of `epoch`; another epoch's, as by another player given it, ends the journal. */
+  op(text: string, epoch: number): void {
+    if (!this.open) {
+      return;
+    }
+
+    this.epoch ??= epoch;
+    if (epoch !== this.epoch) {
+      this.open = false;
+      return;
+    }
+
+    this.ops.push(text);
+  }
+
+  /** ABC `index` compiled, read or imported: `module`, with its `log`, null where it has none to replay. */
+  compiled(
+    index: number,
+    epoch: number,
+    module: { text?: string; url?: string },
+    log: string | null,
+  ): void {
+    this.op(`compile ${index}`, epoch);
+    if (!this.open || log === null) {
+      return;
+    }
+
+    this.places.set(index, this.ops.length - 1);
+    const text =
+      module.text === undefined || typeof Blob !== "function"
+        ? module.text
+        : new Blob([module.text], { type: "text/javascript" });
+    this.modules.set(this.ops.length - 1, {
+      ...(text === undefined ? {} : { module: text }),
+      ...(module.url === undefined ? {} : { url: module.url }),
+      log,
+    });
+  }
+
+  /** Stop journaling, keeping what was: the ABCs added so far are `hashes`. */
+  freeze(hashes: string[]): void {
+    if (this.frozen) {
+      return;
+    }
+
+    this.open = false;
+    this.frozen = { ops: this.ops, hashes: hashes.slice(), modules: [...this.modules] };
+  }
+
+  /** Let go of ABC `index`'s module, which did not load: a worker compiles it. */
+  forget(index: number): void {
+    const place = this.places.get(index);
+    if (place === undefined) {
+      return;
+    }
+
+    this.modules.delete(place);
+    if (this.frozen) {
+      this.frozen.modules = this.frozen.modules.filter(([at]) => at !== place);
+    }
+  }
+
+  /** Stop journaling and let the modules go: no worker will be handed them. */
+  drop(): void {
+    this.open = false;
+    this.ops.length = 0;
+    this.modules.clear();
+    this.places.clear();
+    this.frozen = { ops: [], hashes: [], modules: [] };
+  }
+
+  /** What a worker is handed: null if nothing. */
+  handed(hashes: string[]): HandedModules | null {
+    const handed = this.frozen ?? { ops: this.ops.slice(), hashes, modules: [...this.modules] };
+    return handed.modules.length ? handed : null;
+  }
+}
+
+/** A worker's side: its journal checked against the primordial's, and the logs of the modules it took, until replayed. */
+export class ModuleHandover {
+  private readonly modules: Map<number, HandedModule>;
+  private at = 0;
+  private matching = true;
+  /** How many of the worker's ABCs are known to be the primordial's. */
+  private same = 0;
+  private readonly pending: { index: number; log: string }[] = [];
+  /** A replay that failed: the domain is as no compile left it, and the compiler is not used again. */
+  private failed: Error | null = null;
+
+  constructor(private readonly handed: HandedModules) {
+    this.modules = new Map(handed.modules);
+  }
+
+  /** A call on the worker's compiler, as the primordial journals one. */
+  op(text: string): void {
+    if (this.matching) {
+      this.matching = this.handed.ops[this.at] === text;
+      this.at++;
+    }
+  }
+
+  /** A call the journal does not follow: nothing more is taken. */
+  stop(): void {
+    this.matching = false;
+  }
+
+  /**
+   * The primordial's module for ABC `index`, to load in place of compiling
+   * it, if its compile comes next in the primordial's journal and every
+   * ABC so far, `hashes`, is the primordial's; the compile is journaled
+   * then, and its log kept for replay. Null if not: the caller compiles.
+   */
+  take(index: number, hashes: string[]): HandedModule | null {
+    const module = this.matching ? this.modules.get(this.at) : undefined;
+    if (
+      module === undefined ||
+      this.handed.ops[this.at] !== `compile ${index}` ||
+      !this.sameAbcs(hashes)
+    ) {
+      return null;
+    }
+
+    this.modules.delete(this.at);
+    this.at++;
+    this.pending.push({ index, log: module.log });
+    return module;
+  }
+
+  private sameAbcs(hashes: string[]): boolean {
+    if (hashes.length > this.handed.hashes.length) {
+      return false;
+    }
+
+    while (this.same < hashes.length && hashes[this.same] === this.handed.hashes[this.same]) {
+      this.same++;
+    }
+
+    return this.same === hashes.length;
+  }
+
+  /**
+   * `codegen`, which before any call replays the logs of the modules taken
+   * so far, so that the domain is then as their compiles would have left it.
+   */
+  guard(codegen: Codegen): Codegen {
+    const wrapped = new Map<PropertyKey, unknown>();
+    return new Proxy(codegen, {
+      get: (target, key) => {
+        const value = Reflect.get(target, key);
+        if (typeof value !== "function") {
+          return value;
+        }
+
+        let f = wrapped.get(key);
+        if (f === undefined) {
+          f = (...args: unknown[]) => {
+            this.flush(target);
+            return value.apply(target, args);
+          };
+          wrapped.set(key, f);
+        }
+
+        return f;
+      },
+    });
+  }
+
+  /** Replay the logs of the modules taken, in order; once one fails, every call fails. */
+  private flush(codegen: Codegen): void {
+    if (this.failed) {
+      throw this.failed;
+    }
+
+    while (this.pending.length > 0) {
+      const { index, log } = this.pending[0];
+      if (!codegen.replay(log, index)) {
+        this.failed = new Error(
+          "swf2es: a module the primordial handed to a worker did not replay",
+        );
+        throw this.failed;
+      }
+
+      this.pending.shift();
+    }
+  }
+}
+
+/** The bytes of "WorkerDomain", the class an ABC names to make a worker. */
+const WORKER_DOMAIN = Array.from("WorkerDomain", (c) => c.charCodeAt(0));
+
+/** Whether any of `abcs` names WorkerDomain in its strings: only then may its SWF make a worker. */
+export function namesWorkerDomain(abcs: Uint8Array[]): boolean {
+  const first = WORKER_DOMAIN[0];
+  for (const abc of abcs) {
+    const end = abc.length - WORKER_DOMAIN.length;
+    for (let at = abc.indexOf(first); at !== -1 && at <= end; at = abc.indexOf(first, at + 1)) {
+      let k = 1;
+      while (k < WORKER_DOMAIN.length && abc[at + k] === WORKER_DOMAIN[k]) {
+        k++;
+      }
+
+      if (k === WORKER_DOMAIN.length) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}