@swf2es/runtime 0.1.15 → 0.1.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swf2es/runtime",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "AVM2 and AVM1 language runtime used by generated code",
   "keywords": [
     "actionscript",
@@ -41,6 +41,6 @@
     "LICENSE.third-party"
   ],
   "dependencies": {
-    "@swf2es/format": "0.1.15"
+    "@swf2es/format": "0.1.16"
   }
 }

package/src/avm2/cache-fill.ts

@@ -33,7 +33,10 @@ import {
 /**
  * Keep what `mn` found on `traits`, `o`'s, in `head`, its cache: a
  * binding, as getProperty, setProperty and callProperty use it, or a
- * dynamic property's name. Not where the name resolves otherwise: through
+ * dynamic property's name, on a sealed object too, whose prototypes have
+ * dynamic properties all the same (a script may give a class's prototype a
+ * function, and call it on the class's objects by name, as an obfuscator
+ * may have it do). Not where the name resolves otherwise: through
  * a property hook (a Proxy's, XML's), an index (a Vector's, an Array's
  * element), or a Dictionary's key; nor on a primitive's dynamic property,
  * which its prototypes have.
@@ -58,7 +61,6 @@ export function fillCache(
       name === null ||
       (typeof o !== "object" && typeof o !== "function") ||
       hook !== null ||
-      !traits.dynamic ||
       traits.refusesNames ||
       traits.getIndex !== undefined ||
       traits.index !== undefined ||
@@ -109,11 +111,7 @@ export function fillCache(
     mn.cache = head;
   }
 
-  const e = entryFor(head, traits);
-  if (e === null) {
-    return;
-  }
-
+  const e = entryFor(head, traits, mn);
   e.traits = traits;
   e.kind = kind;
   e.key = key;

package/src/avm2/descriptors.ts

@@ -4,6 +4,7 @@
 
 import type { Domain, Script } from "./domain.js";
 import type { Multiname, Namespace, TypeName } from "./names.js";
+import type { ScopeFinds } from "./property-cache.js";
 import type { ClassRef, VectorRef } from "./traits.js";
 
 // biome-ignore lint/suspicious/noExplicitAny: AS3 values are untyped
@@ -16,8 +17,11 @@ export type Method = Function;
 /** Not a property: distinct from undefined, which a property can hold. */
 export const NOT_FOUND = Symbol("not found");
 
-/** A scope chain: its objects, outermost first, and a bit per with scope in w. */
-export type Scope = Value[] & { w: number };
+/**
+ * A scope chain: its objects, outermost first, and a bit per with scope in
+ * w; what findProperty found on it, once asked (Runtime.outerScopeOf).
+ */
+export type Scope = Value[] & { w: number; found?: ScopeFinds | null };
 
 /** A method factory: the method's function, once its scope chain is known. */
 export type Factory = (scope: Scope, sup: AsObject | null) => Method;

package/src/avm2/errors.ts

@@ -11,6 +11,14 @@ import type { Runtime } from "./runtime.js";
 /** Thrown for an AS3 exception that is an Error the runtime made, before its class existed. */
 export class AsError extends Error {}
 
+/**
+ * Thrown where a SWF asks for something swf2es has not got (Runtime.unsupported).
+ * Uncaught, it stops the script as any error of the runtime's own does; an
+ * AS3 catch gets it as an AS3 error (Runtime.caught), since content written
+ * for several runtimes guards what one of them may lack with try and catch.
+ */
+export class UnsupportedError extends Error {}
+
 /**
  * Where an AS3 error was made, as JavaScript stack lines from the first
  * compiled method's (their names begin with `$`), the runtime's and the
@@ -29,6 +37,16 @@ export function stackOf(error: Value): string | null {
   return frames.slice(Math.max(0, first)).join("\n");
 }
 
+/**
+ * What an error the runtime made says in full, its text and arguments as
+ * debugger mode words them, for a host to show: the release player's
+ * message, which the SWF sees, is the number alone. Null for any other value.
+ */
+export function detailOf(error: Value): string | null {
+  const detail = (error as { $detail?: unknown } | null)?.$detail;
+  return typeof detail === "string" ? detail : null;
+}
+
 /**
  * Error `id`'s message as AS3 sees it: its number, as the release player
  * and avmshell give it, or with its text and arguments in debugger mode.

package/src/avm2/index.ts

@@ -8,6 +8,7 @@ export { Reader as Amf3Reader, Writer as Amf3Writer } from "./amf.js";
 export { builtinLibrary } from "./builtin-library.js";
 export type { Abc, AsObject, CompileUnit, FoundDefinition, Method, Value } from "./descriptors.js";
 export { type Domain, frameScripts, frameSites, siteScript, stackFrames } from "./domain.js";
+export { UnsupportedError } from "./errors.js";
 export { FloatValue, hasFloatLibrary } from "./float.js";
 export { floatLibrary } from "./float-library.js";
 export type { ClassHook, NativesProvider } from "./hooks.js";

package/src/avm2/names.ts

@@ -85,6 +85,11 @@ export const CONSTANT_MultinameA = 0x0e;
 export const CONSTANT_MultinameL = 0x1b;
 export const CONSTANT_MultinameLA = 0x1c;
 
+// What a name made at run time was made of (Multiname.made).
+export const MADE_Unknown = 0;
+export const MADE_Number = 1;
+export const MADE_Value = 2;
+
 /**
  * A name as a property lookup uses it: its namespaces, each with the API
  * version it sees bindings at, and its local name, null for any name.
@@ -121,6 +126,14 @@ export class Multiname {
   cls: AsObject | null = null;
   /** Fixed at construction so indexed access needs no getter in its hot path. */
   readonly elementName: boolean;
+  /**
+   * What made it, where the code's own value did at run time: a number
+   * read or written as an element (MADE_Number), which avmplus hands a
+   * Proxy as its string, or a string or any other value (MADE_Value), which
+   * it hands it as a QName. MADE_Unknown for a name of the code's own and
+   * one the runtime made.
+   */
+  made = MADE_Unknown;
 
   constructor(
     readonly kind: number,

package/src/avm2/natives/proxy.ts

@@ -7,7 +7,16 @@
 
 import type { AsObject, Value } from "../descriptors.js";
 import type { ClassHook, PropertyHook } from "../hooks.js";
-import { type Multiname, NS_Public, namespace, publicNs, publicQname, qname } from "../names.js";
+import {
+  MADE_Number,
+  MADE_Unknown,
+  type Multiname,
+  NS_Public,
+  namespace,
+  publicNs,
+  publicQname,
+  qname,
+} from "../names.js";
 import type { Runtime } from "../runtime.js";
 import type { Natives } from "./define.js";
 
@@ -15,8 +24,11 @@ const FLASH_PROXY = namespace(NS_Public, "http://www.adobe.com/2006/actionscript
 
 /**
  * The name a flash_proxy method gets for `mn`: a QName that was the name
- * stays one, an index comes as its string, as avmplus' getUintProperty
- * interns it, and any other name as a QName in its namespace.
+ * stays one; a number read or written as an element comes as its string,
+ * as avmplus' getUintProperty and getpropertylate_d intern it, whatever
+ * the number; a string or another value of the code's comes as a QName,
+ * "0" too, as does any other name, in its namespace. A name whose maker
+ * is not known is told by its string: an index's is the string.
  */
 function nameFor(rt: Runtime, mn: Multiname): Value {
   if (mn.key !== undefined && (mn.key as AsObject)?.$local !== undefined) {
@@ -24,7 +36,11 @@ function nameFor(rt: Runtime, mn: Multiname): Value {
   }
 
   const name = mn.name;
-  if (name !== null && !mn.attribute && isIndex(name)) {
+  if (
+    name !== null &&
+    !mn.attribute &&
+    (mn.made === MADE_Number || (mn.made === MADE_Unknown && isIndex(name)))
+  ) {
     return name;
   }
 

package/src/avm2/options.ts

@@ -8,6 +8,11 @@ import type { Runtime } from "./runtime.js";
 export interface RuntimeOptions {
   /** Where trace and print write a line. */
   print?: (line: string) => void;
+  /**
+   * Told what is not supported that the code asked for and caught, once
+   * for each: caught, it reaches no one else.
+   */
+  onUnsupported?: (message: string) => void;
   /**
    * Behave as the debugger player: error messages carry avmplus' text
    * ("Error #1009: Cannot access ..."), and System.isDebugger is true. By

package/src/avm2/property-cache.ts

@@ -11,8 +11,13 @@
 // entry still looks for the property on the object, which may have lost it,
 // then on its prototypes, which may have gained or lost it, and leaves
 // what neither has to the full lookup.
+//
+// A name looked up on more traits than its cache keeps, as `x` is on every
+// class with an x, stops replacing entries; what it finds on traits it has
+// no entry for is kept on those traits instead, by name, so that the one
+// class it is mostly read on is not left to the full lookup.
 
-import type { Method, TypeRef } from "./descriptors.js";
+import type { AsObject, Method, TypeRef } from "./descriptors.js";
 import type { Multiname } from "./names.js";
 import type { Traits } from "./traits.js";
 
@@ -25,7 +30,7 @@ export const IC_GetSet = 5;
 export const IC_Method = 6;
 /** A method a property hook resolves the name of for get and set, as XML's: callproperty only. */
 export const IC_Call = 7;
-/** No binding: a dynamic property, the object's own or else a prototype's, if either has it. */
+/** No binding: a dynamic property, the object's own (a dynamic object's) or else a prototype's, if either has it. */
 export const IC_Dynamic = 8;
 
 /** Entries a name keeps, for as many traits, before it replaces the oldest. */
@@ -35,7 +40,7 @@ const ENTRIES = 8;
  * keeps would replace one on every miss, and still miss as often. It keeps
  * those it has until the epoch changes.
  */
-export const REPLACEMENTS = 16;
+const REPLACEMENTS = 16;
 
 /**
  * One traits' entry for a name. A name's first entry heads its list and
@@ -70,6 +75,8 @@ export function epoch(): number {
 
 /** The caches filled in this epoch, which invalidate empties so that they keep no traits or code. */
 const filled: PropertyCache[] = [];
+/** The traits given entries of their own in this epoch (Traits.manyTraitsEntries). */
+const filledTraits: Traits[] = [];
 
 /** Note that `head`'s cache is being filled in this epoch. */
 function filling(head: PropertyCache): void {
@@ -88,6 +95,11 @@ export function invalidate(): void {
   }
 
   filled.length = 0;
+  for (let i = 0; i < filledTraits.length; i++) {
+    filledTraits[i].manyTraitsEntries = null;
+  }
+
+  filledTraits.length = 0;
   current++;
 }
 
@@ -98,11 +110,12 @@ export const UNFILLED = new PropertyCache();
 
 /** The entry of `mn`'s cache for objects with traits `t`, or null. */
 export function cached(t: Traits | undefined, mn: Multiname): PropertyCache | null {
-  let e: PropertyCache | null = mn.cache;
-  if (t === undefined || e.epoch !== epoch()) {
+  const head = mn.cache;
+  if (t === undefined || head.epoch !== epoch()) {
     return null;
   }
 
+  let e: PropertyCache | null = head;
   do {
     if (e.traits === t) {
       return e;
@@ -111,16 +124,20 @@ export function cached(t: Traits | undefined, mn: Multiname): PropertyCache | nu
     e = e.next;
   } while (e !== null);
 
+  if (head.replaced === REPLACEMENTS && t.manyTraitsEntries !== null) {
+    return t.manyTraitsEntries.get(mn) ?? null;
+  }
+
   return null;
 }
 
 /**
- * The entry of a cache to fill for traits `t`: its own, a free one, a new
- * one while the list is shorter than ENTRIES, else the oldest, until it has
- * replaced REPLACEMENTS; then none. A cache of an earlier epoch is emptied
- * first.
+ * The entry of `mn`'s cache, `head`, to fill for traits `t`: its own, a
+ * free one, a new one while the list is shorter than ENTRIES, else the
+ * oldest, until it has replaced REPLACEMENTS; then one `t` keeps for `mn`.
+ * A cache of an earlier epoch is emptied first.
  */
-export function entryFor(head: PropertyCache, t: Traits): PropertyCache | null {
+export function entryFor(head: PropertyCache, t: Traits, mn: Multiname): PropertyCache {
   if (head.epoch !== epoch()) {
     for (let e: PropertyCache | null = head; e !== null; e = e.next) {
       e.traits = null;
@@ -150,7 +167,7 @@ export function entryFor(head: PropertyCache, t: Traits): PropertyCache | null {
   }
 
   if (head.replaced === REPLACEMENTS) {
-    return null;
+    return traitsEntry(t, mn);
   }
 
   head.replaced++;
@@ -158,3 +175,32 @@ export function entryFor(head: PropertyCache, t: Traits): PropertyCache | null {
   head.victim = victim.next ?? head;
   return victim;
 }
+
+/** The entry `t` keeps for `mn`, a name its cache has no room for. */
+function traitsEntry(t: Traits, mn: Multiname): PropertyCache {
+  let entries = t.manyTraitsEntries;
+  if (entries === null) {
+    entries = new Map();
+    t.manyTraitsEntries = entries;
+    filledTraits.push(t);
+  }
+
+  let e = entries.get(mn);
+  if (e === undefined) {
+    e = new PropertyCache();
+    entries.set(mn, e);
+  }
+
+  return e;
+}
+
+/**
+ * Which of a scope chain's objects binds each name findProperty looked up
+ * on it, the innermost that does, or null where none does, in the epoch it
+ * was found in: a chain's objects never change, nor do their traits'
+ * bindings within an epoch. Only for a chain without a with scope, which
+ * has a name by its dynamic properties too.
+ */
+export class ScopeFinds extends Map<Multiname, AsObject | null> {
+  epoch = current;
+}