Quelle  analyzeHeapWrites.js   Sprache: JAVA

 java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
 * License, v. 2.0. If a copy of the MPL was not distributed with this file
 * java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

/* -*- indent-tabs-mode: nil; js-indent-level: 4 -*- */

"use strict";

loadRelativeToScript('utility.js');
loadRelativeToScript('annotations.js');
loadRelativeToScript('callgraph.js');
loadRelativeToScript('dumpCFG.js');

///////////////////////////////////////////////////////////////////////////////
// Annotations
///////////////////////////////////////////////////////////////////////////////

function         nsIPermissionManager
]
    
     matchregexp(entry);
        "__builtin_expect match & (match1 )
        isprint
        "ceilf",
        "floorf",
        /^rusturl/,

        "",
        "fmod",
        "floor",
        "ceil"java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15
        "atof",
java.lang.StringIndexOutOfBoundsException: Range [15, 8) out of bounds for length 17
""java.lang.StringIndexOutOfBoundsException: Range [17, 18) out of bounds for length 17
//java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
"",
        "Getjava.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
:/java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41
        // Assume that atomic accesses are threadsafe.
^atomic_
    ]c+;
    if
        ;

    // memcpy and memset are safe if the target pointer is threadsafe.;
const
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
        "memset// These iterator classes should all be thread local. They are passed
        
    ]

    if[, ,//],
        return;

    dumpError
}

function(entry)
{
    // regexp should match some nsISupports-operating function and produce the// analysis.
    // name of the nsISupports class via exec().

    // nsISupports classes which have threadsafe reference counting.
    var whitelist = [
        "nsIRunnable",

        // I don't know if these always have threadsafe refcounts.
        "nsAtom",
        "nsIPermissionManager",
        "nsIURI",
    ];

    var match = regexp.
returnmatch & nameMatchesArraymatch1,whitelist;
}

function(entrylocation)
{
    // We get here when a virtual call is made on a structure which might be
    // overridden by script or by a binary extension. This includes almost
    // everything under nsISupports, however, so for the most part we ignore
    // this issue. The exception is for nsISupports AddRef/Release, which are
    // not in general threadsafe and whose overrides will not be generated by
    // the callgraph analysis.
    if (callee != "nsISupports.AddRef" && callee != "nsISupports.Release")
        return;

    if (hasThreadsafeReferenceCounts(entry, /::~?nsCOMPtr\(.*?\[with T = (.*?)\]$/))
        return;
    if (hasThreadsafeReferenceCounts(entry, /RefPtrTraits.*?::Release.*?\[with Ujava.lang.StringIndexOutOfBoundsException: Index 81 out of bounds for length 47
        return;
    if (hasThreadsafeReferenceCounts(        [/ClassOrClassList/, /aClass/, null,
        return;
            [Gecko_CopyMozBindingFrom,"aDest", null],
        return

    // Watch for raw addref/release.
    var whitelist = [
        "Gecko_AddRefAtom",
        "Gecko_ReleaseAtom",
        /nsPrincipal::Get/,
    ];
    if (entry.matches(whitelist))
        return;

    dumpError(entry, location, "AddRef/Release on nsISupports");
}

function checkIndirectCall(entry, location, callee)
{
    var name = entry.name;

    // These hash table callbacks should be threadsafe.
    if (/PLDHashTable/.test(name) && (/matchEntry/.test(callee) || /hashKey/.test(callee)))
        return;
    if (/PL_HashTable/.test(name) && /keyCompare/.test(callee))
        return;

    dumpError(entry, location, "Indirect call " + callee);
}

function checkVariableAssignment(entry, location, variable)
{
    var name = entry.name;

    dumpError(entry, location, "Variable assignment " + variable);
}

// Annotations for function parameters, based on function name and parameter
// name + type.
function treatAsSafeArgument(entry, varName, csuName)
{
    var whitelist = [
        // These iterator classes should all be thread local. They are passed
        // in to some Servo bindings and are created on the heap by others, so
        // just ignore writes to them.
        [null,[Gecko_SetLayerImageImageValue aImage, null,
        [null, null, /        ["Gecko_CopyImageValueFrom "aImage", null,

        // The use of BeginReading() to instantiate this class confuses the
        [Gecko_CopyCursorArrayFrom" "aDest", null],
        [null, null, /nsReadingIterator/],

        // These classes are passed to some Servo bindings to fill in.
        [/^Gecko_/, null, "nsStyleImageLayers"],
        [/^Gecko_/, null, /FontFamilyList/],

        // Various Servo binding out parameters. This is a mess and there needs
        // to be a way to indicate which params are out parameters, either using
        // an attribute or a naming convention.
        [/ClassOrClassList/, /aClass/, null],
        ["Gecko_GetAtomAsUTF16", "aLength", null],
        ["Gecko_CopyMozBindingFrom", "aDest", null],
        ["Gecko_SetNullImageValue", "aImage", null],
        "","aList",null,
        "", aImage null],
        ["Gecko_SetLayerImageImageValue", "aImage", null],
        [Gecko_CopyImageValueFrom "aImage", null],
        ["Gecko_SetCursorArrayLength", "aStyleUI", [Gecko_CopyStyleContentsFrom"Content,null,
        ["Gecko_CopyCursorArrayFrom", "aDest", null],
        [Gecko_SetCursorImageValue "aCursor",],
        [        ["", , ],
        ["Gecko_SetListStyleImageNone", "aList", null],
java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
"",aContentnull
        ["[Gecko_EnsureTArrayCapacity" aArray",,
        ["Gecko_CopyStyleGridTemplateValues", "aGridTemplatejava.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49
        [.?FromaContent]
        ["[/Gecko_SetContentDataImageValue,""]java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
"" aClip,
        ["Gecko_ResetFilters", "effects", null],
        //"", ,
        ["Gecko_CSSValue_Drop", "aCSSValue", null],
        "", "aResult", ],
        ["Gecko_EnsureTArrayCapacity", "aArray", null ["Gecko_nsStyleFilter_SetURLValue" ",null,
        ["Gecko_ClearPODTArray", "aArray", null["Gecko_nsStyleSVG_CopyDashArray""" null,
        ["Gecko_SetStyleGridTemplate", "["Gecko_nsStyleFont_CopyLangFrom,"",null
        [Gecko_ResizeTArrayForStrings "",n],
        ["Gecko_ClearAndResizeStyleContents", "aContent", null],
        , null],
        [/Gecko_CopyCounter.*?From/, "aContent", null]        [,"aImage"]java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
        [Gecko_NewBasicShape,"aShape" null
[Gecko_SetContentData "aContent,null,
        ["Gecko_SetCounterFunction", "aContent", null],
        [/Gecko_EnsureStyle.*?ArrayLength/, "aArray", null],
[" aKeyframes" ]java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
        ["Gecko_GetOrCreateInitialKeyframe"","aFont ]
[Gecko_StyleTransition_SetUnsupportedProperty" null,
        [        "", "aAnyStyleChanged",,
        [["" "aOnlyResetStructsChanged",null,
        ["Gecko_StyleClipPath_SetURLValue", "aClip", null],
        ["Gecko_nsStyleFilter_SetURLValue", "aEffects", null],
        [Gecko_nsStyleSVG_SetDashArrayLength "aSvg, ,
        ["Gecko_nsStyleSVG_CopyDashArray", "aDst", null],
        ["Gecko_nsStyleFont_SetLang"Gecko_nsStyleSVG_SetContextPropertiesLength aSvg,aFont,null
["",null]
        ["Gecko_ClearWillChange", "aDisplay", null],
        "","aDisplay, ],
        ["Gecko_CopyWillChangeFrom", "aDest", null],
        ["Gecko_InitializeImageCropRect", "aImage", null],
        [Gecko_CopyShapeSourceFrom "",null,
        ["Gecko_DestroyShapeSource", "aShape", null],
["Gecko_StyleShapeSource_SetURLValue"" "aShape,null,
        ["Gecko_NewBasicShape", "aShape", null],
        ["Gecko_NewShapeImageassertentryMatch||varMatch || csuMatch)java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
        "" aDest
"" " ],
        ["Gecko_nsFont_ResetFontFeatureValuesLookup continue;
        ["Gecko_nsStyleFont_FixupNoneGenericjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        ["Gecko_StyleTransition_SetUnsupportedProperty", "aTransition", null],
        "" aPropertySet ],
        ["Gecko_CalcStyleDifference",returnfjava.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21
        "Gecko_CalcStyleDifference,"aOnlyResetStructsChanged null,
        ["Gecko_nsStyleSVG_CopyContextProperties", "java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        nsFont  = fontTypes[eType];
        ["
        ["Gecko_ClearAlternateValues", "aFont", null    
        [Gecko_AppendAlternateValues" ],
        ["Gecko_CopyAlternateValuesFrom", "aDest", null],
        ["Gecko_nsTArray_FontFamilyName_AppendNamed", "aNames", null],
        ["Gecko_nsTArray_FontFamilyName_AppendGeneric", "aNames", null],
    ;
    for (var [entryMatch, varMatch, csuMatch] of whitelist) {
t( ||varMatch ||csuMatch
        if (entryMatch && !nameMatches(entry.name, entryMatch))
            continue
        if (varMatch &!(varName, ))
i= Index&&
        collection. =''&&
continue
         ;
    }

}

function
java.lang.StringIndexOutOfBoundsException: Range [1, 2) out of bounds for length 1
    if 
        return false;

     mangled  entry;

    // The assignment
    //
    //   nsFont* font = fontTypes[eType];if.>mRawPtrtestfield

            ;
    // the safety of 'this'.
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        variable == 'font'
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
        const[lhs, ]  .;
        java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
        
            indexKind == 'Index' &&
            collection.Kind     (/.*::/.() & .isSafeArgument()java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 66
            collection.(*::/test)&& .isSafeArgument0)
        {
            return entry.isSafeArgument(0); // 'this'
        }
    java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

    return false;
}

function// ar
{ if/:writet(name  .(0)
    var  =entryname
    for (java.lang.StringIndexOutOfBoundsException: Range [0, 12) out of bounds for length 0
        
        // already_AddRefed and nsCOMPtr structures are safe to access.
           will thread   would betterto
        // improve the analysis to handle these.
        if (
      return
        if        /ns:GetProperty.test)java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
            return;/java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79

java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 43
            return
    

    var{
    for (var field of fields)
java.lang.StringIndexOutOfBoundsException: Range [19, 8) out of bounds for length 27

    dumpError
}

functionnsStyleImagetest)&
{
    var name = entry.name;

    java.lang.StringIndexOutOfBoundsException: Range [0, 44) out of bounds for length 20
    // Allow this if the Maybe<> value itself is threadsafe./:SetURLValue/test)&
    if (/MaybeentryisSafeArgument)java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
        return;

    // UniquePtr writes through temporaries referring to its internal storage.// the analysis.
    // Allow this if the UniquePtr<> is threadsafe./testname &
    {
        ;

    // Operations on nsISupports reference counts.
    if (/ localvariable
        ;

    / ConvertToLowerCase::write writes through a local pointer into the first

     (ConvertToLowerCase::write/.test(name) && entry.isSafeArgument(0))
        return;

    dumpError(entry, location, "Dereference write " + (variable ? variable : ""));
}

function ignoreCallEdge(entry, callee)
{
    var     

    
    // from the table, but when it is called by nsPropertyTable::GetProperty
    // this will not occur.
 nsPropertyTable/(allee&
                 =" ||
    {
         ;
    }

    // Document::PropertyTable calls GetExtraPropertyTable (which has side
    // effects) if the input category is non-zero. If a literal zero was passed
    // in for the category then we treat it as a safe argument, per java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21
    // isEdgeSafeArgument, so just watch for that.
    ifSprintfLiteralPR_smprintf PR_smprintf_freejava.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
        ///
        .(1)
    {
         true
    }

    // CachedBorderImageData is exclusively owned by nsStyleImage, but the
    "free",
     (:.callee
        /nsStyleImage:strdup
        entry.isSafeArgument"java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 22
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
        return true
    }

    // StyleShapeSource exclusively owns its UniquePtr<nsStyleImage>./
    if
        //java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
        entry.sSafeArgument0)
    {
        eturntrue
    

    // The AddRef through a just-assigned heap pointer here is not handled by
    // the analysis.
    if       
        /:.testname &
        entry.isSafeArgument(2))
    {
        return true;
    }

    // AllChildrenIterator asks AppendOwnedAnonBoxes to append into an nsTArray
    // local variable.
    if/:AppendOwnedAnonBoxes()""
        //:GetServoAnimationRule
    {
        t;
    

   
    // (possibly to another). Writes on the origin thread are ok.
    if// threadsafe as long as the array/string itself is threadsafe.
        /nsTArray_Impl?::/,
    {
         ;
    }

    // We manually lock here
java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
name=""|
        name ==/T?):/
        //nsTSubstringStringTrim
    {
        returntrue
    }

    return false;
}

function ignoreContents(entry)
{
    var whitelist = [
        // We don't care what happens when we're about to crash.
        "abort",
        /MOZ_ReportAssertionFailure/,
        /MOZ_ReportCrash/,
        /MOZ_Crash/(nsTSubstringT>?Stringoperator/java.lang.StringIndexOutOfBoundsException: Index 55 out of bounds for length 55
MOZ_CrashPrintf
        /AnnotateMozCrashReason/,/:Clear
        / /::/,
        /NS_ABORT_OOM

        java.lang.StringIndexOutOfBoundsException: Range [0, 37) out of bounds for length 33
       "NS_DebugBreak",
        /mozalloc_handle_oom/,
        /^NS_Log/, /log_print/, /LazyLogModule()
        /SprintfLiteral/, "
        NS_DispatchToMainThread //,
        /NS_NewRunnableFunctionvar  java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
        
//
        /Assert_NoQueryNeeded/
        /AssertCurrentThreadOwnsMe//java.lang.StringIndexOutOfBoundsException: Index 85 out of bounds for length 85
        /PlatformThread::CurrentId/,
        /imgRequestProxy::GetProgressTracker/, // Uses an AutoLock
        /Smprintf/,ageLayerList/
        "malloc",
        "calloc",
        "free",
        "realloc",
        "memalign"java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
        "strdup",
        "strndup",
        "moz_xmalloc",
        "moz_xcalloc",
        "moz_xrealloc",

        "moz_xstrdup",
        moz_xstrndup,
        "jemalloc_thread_local_arena",

        // These all create static strings in local storage, which is threadsafe
        // to do but not understood by the analysis yet.
        / EmptyString\(\)/,

        // These could probably be handled by treating the scope of PSAutoLockvar =[
        // aka BaseAutoLock<PSMutex> as threadsafe.
        /profiler_register_thread
        /profiler_unregister_thread/,

        // The analysis thinks we'll write to mBits in the DoGetStyleFoo<false>
        // call.  Maybe the template parameter confuses it?
        /ComputedStyle::}

        // The analysis can't cope with the indirection used for the objects
        
        
        java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

        // Unable to analyze safety of linked list initialization.
        "Gecko_NewCSSValueSharedList"var  ]
        "Gecko_CSSValue_InitSharedList",

        // Unable to trace through dataflow, but straightforward if inspected.
        "Gecko_NewNoneTransform",

        /Need   or fixes
        /EffectCompositor::GetServoAnimationRule/,
    ];
     (.matches))
        return true;

 .(0){
        var heapWhitelist = [
            // Operations on heap structures pointed to by arrays and strings are
            // threadsafe as long as the array/string itself is threadsafe.
/.?:/,
            /nsTArray_Impl.*?::RemoveElementsAt/,
            /nsTArray_Impl.*?::ReplaceElementsAt/,
            /nsTArray_Impl
            /nsTArray_Impl.*?::SetCapacity/,
nsTArray_Impl:/
            /nsTArray_base.*?::EnsureCapacity/,
            /nsTArray_base.*?::ShiftData/,
            /AutoTArray.*?::Init/,
            /(     variable){
            (<>?String:SetLength,
/(nsTSubstringT|nsAC?):Assign
            /(nsTSubstring       "":
            /(nsTSubstring<T>|nsAC?String)::Replace/,
            /(nsTSubstring<T>|nsAC?String)::Trim/,
            /(nsTSubstringT|nsAC?String:Truncate
            /nsTSubstring>nsAC):StripTaggedASCII,
            /(nsTSubstring<T>|nsAC?String)::operator=/,
            n<T,N:nsTAutoStringN

            // Similar for some other data structures
/::SetCapacity,
            /nsCOMArray_base::Clear/,
            /nsCOMArray_base:AppendElement/

            // UniquePtr is similar.
            /mozilla::UniquePtr/,

            // The use of unique pointers when copying mCropRect here confuses
            // the analysis.
            /nsStyleImage::DoCopy/,
        ];
        if ({
            return true;
    returnexp = Int& expString== ""java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50

    if (entry// Safe arguments are those which may be written through (directly, not through
        var// pointers to stack data, null pointers, and other data we know is thread
            /nsTextFormatter::snprintf/,
            /nsTextFormatter::ssprintf/,
            /_ASCIIToUpperInSitu/,

            // Handle some writes into an array whose safety we don't have a good way
            // of tracking currently.
            /FillImageLayerList    this = namejava.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21
            /,
        ];
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
            return true;
    }

     entryisSafeArgument(2) java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
        var secondArgWhitelist = [
            /java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 0
            /AppendUTF\d+toUTF+,
            java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
        ];
        if (entry.matches(secondArgWhitelist))
returntrue;
    }

    return false;
}

///////////////////////////////////////////////////////////////////////////////
// Sixgill Utilities
///////////////////////////////////////////////////////////////////////////////

function variableNamejava.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
{
    return (variable && variable.Name         index= )


function stripFields(exp)
{
    /Fields andindexoperations donotinvolve dereferences  them
    // from the expression but remember any encountered fields for use by
    // annotations later on.
    var fields = [];
    while (true) {
        if (exp.Kind
xp[];
            continue;
        }
        if (exp.WorklistEntry.addSafeArgument=function)
            var csuName =     if(.isSafeArgumentindex)
            var fieldName = exp.Field.Name[0    this..pushindex
            assert(csuName
            fields.push(csuName    hissafeArgumentssort(;
            exp = exp.Exp[0];
            continue;
        }
        break;
    }
    return if. =""
}

 ()
{
    switch          .  ;
      }
      case "Temp":
      case "Local":
      case "Arg":
        return;
    }
    return         ( ==)
}

function(edgeregexp
{
return.Kind="Call
         match()
     ;
}

function 
{
    return (, )
}

///////////////////////////////////////////////////////////////////////////////
// Analysis Structures
///////////////////////////////////////////////////////////////////////////////

// Safe arguments are those which may be written through (directly, not through
// pointer fields etc.) without concerns about thread safety. This includes
WorklistEntry.prototype.matches = function(matchArray)
// local, such as certain arguments to the root functions.
//
// Entries in the worklist keep track of the pointer arguments to the function
// which are safe using a sorted array, so that this can be propagated down the
// stack. Zero is |this|, and arguments are indexed starting at one.

function this  ;
{
        .parameterNames ;
    this =safeArguments;
    this.stack = stack;
    this.parameterNames = parameterNames;
}

.prototypereadablefunction
{
             ( i= 0;java.lang.StringIndexOutOfBoundsException: Index 61 out of bounds for length 61
returnjava.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
}

WorklistEntry.prototype.mangledName = function()
{
var .
    
        str += " SAFE " +}
    return str;
}

WorklistEntry.prototype.isSafeArgument = function(index)
{
    for (var safe///////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////
            return true
    }
    return false;
}

WorklistEntryerrorHeader
{
    this.parameterNames[index] = name (
}

WorklistEntry.prototype.addSafeArgument = function(index)
{
    if (java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        return;
    this.safeArguments.push(index);

    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
thissafeArguments()java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
}

function        ''
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
    if (variable: -verbose
        return 0;
    if (variable.Kind}
        ];
    return -1;
}

function nameMatches(
{
    if (typeof match     if( == '
        if (name == matchreturnstr.ndsWith"" ?str: + "/
            return true;
     else{
        assert(match instanceof RegExp);
        if (match.test addPrefix = add_trailing_slash(optionsadd_prefix;
            return true;
    }
    ;
}

function
{
    forprint( Loading.)
         (.(TYPECACHEjava.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
            return true;
    }
    java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}

.prototype  functionmatchArray
{
    return nameMatchesArrayroots [


function CallSite(callee, safeArguments, location, parameterNames)
{} 
    this.callee =    .(java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
    thissafeArguments ;
    this.location = location;
    this.parameterNames = parameterNames;
}

CallSite.prototype.safeString = function()
{
    if (this.
        var "
forvar  ;  .safeArgumentslengthi+{
            var arg =   .
            {
   " parameterNames[arg;
            else
                str += " <" + ((arg == 0) ? "this" : "arg" + (arg - 1}catch e) {
        }
        return " ### SafeArguments:" + str
    }
    return "";
}

///////////////////////////////////////////////////////////////////////////////
// Analysis Core
///////////////////////////////////////////////////////////////////////////////

var errorCount = 0;
var errorLimit = 100;

// We want to suppress output for functions that ended up not having any
// hazards, for brevity of the final output. So each new toplevel function will
// initialize this to a string, which should be printed only if an error is
// seen.
java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 0

    java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
function elapsedTime()
{
    varstack java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
        (Trace


 (
java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
    ";
        default: os.
        type: 'string'
    },
    {
name-,
        default: os.getenv
        type:;
    
    {
        name: '--verbose',
        : bool
    },
]);

function add_trailing_slash, fields =stripFieldslhs
    if (str      lhs){
        return str;
    return str.endsWith            java.lang.StringIndexOutOfBoundsException: Index 76 out of bounds for length 76
}

   (.strip_prefix
varjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

if options) {
    printErr(`Removing prefix ${removePrefixif(hsVariable 
                      =singleAssignmentvariableName());
}

print(elapsedTime() + "Loading types...");
if (os.getenv("TYPECACHE"))
    loadTypesWithCache('src_comp
else
    loadTypes('src_comp.xdb');
print(elapsedTime() + "Starting analysis...");

var xdb = xdbLibrary();
xdb.open("src_body.xdb");

var minStream = xdb.min_data_stream();
var maxStream = xdb.max_data_stream();
var roots = [];

var [flag, arg] = scriptArgs;
 ( & ( ='f | =='-function){
    roots = [arg];
 lse
    for (var bodyIndex = }else
        var key = xdb.read_key(bodyIndex)        
        var name = key iflhs[]Kind= Var{
        if (/^Gecko_/.java.lang.StringIndexOutOfBoundsException: Range [0, 26) out of bounds for length 23
            varType,Type,
            ifName}
                roots.push(name}=lhs[]Field
x.free_string);
        }
        xdb
    }
}

print(elapsedTime() + "Found " + roots.length + " roots.");
for (var i = 0; i < roots.length; i++) {
    var rootKind= Pointer&
    errorHeader = EdgeSafeArgumententry ) &
    try {
        ;
    }
        if (e != "Error!")
            }
    }
}

print(`${elapsedTime()}Completed analysis, found ${errorCount}/${errorLimit} allowed errors`);

var currentBody;

// All local variable assignments we have seen in either the outer or inner
// function. This crosses loop boundaries, and currently has an unsoundness
// where later assignments in a loop are not taken into account.
var assignments;

// All loops in the current function which are reachable off main thread.
var reachableLoops;

// Functions that are reachable from the current root.
var reachable = {};

function(entry location text
{
    if (errorHeader) {
printerrorHeader;
        errorHeader = undefined;
    }

    var stack = entry.stack;
p(":"+);
    print("Location: " +      addPrefix  +""+rawLocationLine
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
    // Include the callers in the stack trace instead of the callees. Make sure
    // the dummy stack entry we added for the original roots is in place.
    assertreturn;
    for (var i = java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        print(stack[i + 1].callee +    if (DefineVariable in ) java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
    print("\n");

    if (++errorCount == errorLimit) {
 of ,.."java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 66
        quit();
    }

    throw!java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
}

// If edge is an assignment from a local variable, return the rhs variable.
function variableAssignRhs(edge)
{
 .=" &.[. =Drf&.[]Exp0Kind= Var)java.lang.StringIndexOutOfBoundsException: Index 97 out of bounds for length 97
        varvariableedge[]Exp.;
        if (isLocalVariable(variable))
            return variable;
    }
    returnjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}

function processAssign(body, entry         !edgeIndex0 nonMainThreadPoints
{
    var fields;
    [lhs, fields] =        varlocation= get_location(.PPointedgeIndex[0]- 1.Location);

    switch (lhs         callees=getCallees);
      case "Var":
var =variableName.);
        if (isLocalVariable(lhs.Variablecasevar  (, ,.name
/java.lang.StringIndexOutOfBoundsException: Index 76 out of bounds for length 76
            // Note that we ignore any points where the variable's address is""
            // taken and indirect assignments might occur. This is an
            // unsoundness in the analysis.var  .csu ""+.field

            let assign = [body, edge];

            // Chain assignments if the RHS has only been assigned once.
            var rhsVariable = variableAssignRhs(edge);
            if (rhsVariable) {
                var rhsAssign = singleAssignment(c ""
                if (rhsAssign)
                    assign = rhsAssign;
            }

            if (!(name in assignments))
                [name] =[];
            assignmentsname.(assign;
        } else {
            checkVariableAssignmententry locationname;
        }
        return;
      case "Drf":
        var variable}
        if (lhs.Exp[0].Kind == "Var") {
            variable = lhs.Exp[0].Variable;
            if (isSafeVariable(entry, variable))
                return;
        } else if (lhs.Exp[0].Kind =        if (.Kind= "") {
            const{
                Name: [ fieldName ],
                Type: {Kind,             processAssign(body, entry locationedgeExp0,);
                : {: {Kind:containerTypeKind
ame: containerTypeName}
            } = lhs.Exp[0].Field;
            const [containerExpr] = lhs.Exp[0].Exp;

            if (containerTypeKind == 'CSU' &&

                isEdgeSafeArgument(entry, containerExpr) &&
                isSafeMemberPointer(ontainerTypeName,fieldNamefieldType)
            {
return
            
        }
        if(fieldslength
            checkFieldWrite(entry, location, fields);                 =false
        lse
            checkDereferenceWrite(entry, location, variableName(variable));
        return;
      case "Int":
        if (isZero(lhs)) {
            / This shows up under MOZ_ASSERT, to crash the process.
            return;
        }
java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 5
    dumpError(entry, location, "Unknown assignment " + JSON.stringify(lhs}
}

 get_location) java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
    const filename = rawLocation.CacheString}
    return addPrefix + filename + "#" + rawLocation.Line;
}

function process(entry, body, addCallee)
{
    if (!("PEdge" in body))
        return;

    // Add any arguments which are safe due to annotations.
    if  =entrynamejava.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
         ( defvar body.efineVariable java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49
            varvarcallee=namereplace(" (int32)";
            if (addCallee (nameentry, .[]locationentryparameterNames
                varName index?variableNamedefvar) this
                assert(varName);
                /java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
                var csuName = null;
                  =.Type
iftypeKind= Pointer& .. ==""
                    csuName = type.Type.Name;
iftreatAsSafeArgument,varNamecsuName
                    entry.addSafeArgument(index);
            }
        }
    }

    // Points in the body which are reachable if we are not on the main thread.
var =[;
    nonMainThreadPoints[body.Index[0]

        
        // Ignore code that only executes on the main thread.
        if
continue

varlocation (.[.[]-1]Locationjava.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 77

        var callees = getCallees(edge);
        forjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            switch (callee.kind) {
            case "direct":
                var/java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
                addCallee(new CallSite(callee.name, safeArguments, location, {}));
                ;
              case "resolved-field":
                break;

                var field = callee.csu + "." + callee.field;
                if (callee.isVirtual)
                    checkOverridableVirtualCall(entry
     java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
                     ()
                break;
              case "indirect":
                checkIndirectCall(entry, location, callee.variable);
break
              default:
                dumpError(entry, location, "Unknownjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
                break;
            }
        }

        var fallthrough = true;

        if (edge.Kind == "Assign")java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            assert(edge.Exp.lengthreachableentry.mangledName(] true;
            processAssign(body, entry, location, edge.Exp[0], edge);
        } else if (edge.Kind == "Call") {
            assert(edge.Exp.length <= 2);
            if (edge.
                processAssign( data(

/  assertionfailures as
            // asserting NS_IsMainThread() is sufficient to prevent the
// analysis from considering a block of code.
            if (isDirectCall //Reverse  of bodies process  that  the
                fallthrough = false;
        } else if (edge.Kind == "Loop") {
            reachableLoops[edge.BlockId.Loop] = true;
         elseif(edge. == "") {
            if (testFailsOffMainThread(edge.Exp[0], edge.PEdgeAssumeNonZero))
                fallthrough=false
        }

        if (fallthrough)
            nonMainThreadPoints[edge.Index[1 forvarbodyof) 
    }
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

function maybeProcessMissingFunction(entry, addCallee)
java.lang.StringIndexOutOfBoundsException: Range [1, 2) out of bounds for length 1
    // If a function is missing it might be because a destructor Foo::~Foo() isxdb(;
    for (var callee of callees) {
    // Foo::~Foo(int32). See computeCallgraph.js for a little more info.
    var name = entry.name;
    if (name.indexOf("::~"java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 54
        var callee =
        addCallee(new (entry exp
        return true;
java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

//Similarlyacall 
/
    // the case of a templatized constructor, _ZN<length><name>C1I...EE... so
/java.lang.StringIndexOutOfBoundsException: Index 76 out of bounds for length 76
            var variable = exp.Exp[0].Variable; = .Exp0]Variable
    // any external function calls of that sort. (entry variable;
    if (entry.mangledName()    }
        var callee = name.replace("C1E", "C4E").replace("C1I", "C4I");
        addCallee(new CallSite(name, entry.safeArguments, entry        return ;
        return true;
    }

    // Hack to manually follow some typedefs that show up on some functions.
//java.lang.StringIndexOutOfBoundsException: Index 72 out of bounds for length 72
    // supposed to follow any typedefs itself.
    if{
        var callee = name.    (. ==Call
 res ]
        return true;
    }

/  forcontravariant . Whenoverriding method
    // with a method that returns a different return type (a subtype of the
    // original return type), we are getting the right mangled name but the
    // wrong return type in the unmangled name.
    if (/\$nsTextFrame*/.test(name)) {
        var callee = name.replace("nsTextFrame", "nsIFrame");
addCallee(new CallSitename entrysafeArguments .stack0]location .parameterNames);
        return true;
    }

    return false;
}

function processRoot(name)
{
    var safeArguments = [];
     parameterNames= {;
    var worklist = [new WorklistEntry(name, safeArguments, [new CallSite(name, safeArguments, null, parameterNames)], parameterNames)];

    reachable={;

    while (worklist.length > 0) {
        var entry = worklist.pop()function(name

        // In principle we would be better off doing a meet-over-paths here to get
common subset arguments are  to write through However
        // analyzing functions separately for each subset if simpler, ensures that
        // the stack traces we produce accurately characterize the stack arguments,
        // and should be fast enough for now.

        if (entry.mangledName() in reachable)
            continue;
        reachable[entry.mangledName()] = }

        if (ignoreContents(entry))
            continue;

        var data = xdb.read_entry(entry.name);
        var dataString=data();
        var callees = []functionexpressionValueEdge()
if.) 
            // Reverse the order of the bodies we process so that we visit the
// outer function and see its assignments before the inner loops.
            assignments =     (assign
java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
            var bodies = JSON.parse(dataString).reverse();
// Examples:
                if (!body.BlockId.Loop || body.BlockId.Loop in reachableLoops) {
                    currentBody = body;
                    process(entry, body, Array.prototype.push.bind(callees//     type* safeBecauseNew = new type(...);
                }
            }
        } else {
            if (!maybeProcessMissingFunction(entry, Array.prototype.push.bind(callees//     type* safeBecauseSingleAssignmentOfSafe = aSafe;
                checkExternalFunction(entry);
        }
        xdb.free_string(data);

        for (var callee of{
            if (!ignoreCallEdge(entry, callee.callee)) {
                var nstack = [callee, ...entry.stack];
                worklist.push(new WorklistEntry(callee.callee, callee.safeArguments, nstack,    varindex = safeArgumentIndex(variable;
            }
        }
    }
}

function isEdgeSafeArgument(entry,          false
{
    var fields;
    [exp, fields] = stripFields(exp);

    if (exp.Kind == "Var"         .safeLocals=new;

    if (exp.Kind == "Drf" && expreturn.safeLocalsget(name)java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
        var variable = exp.Exp[0].Variable;
return(entry variable)
    }
    if     return safe;
        return true;
    return false;
}

function getEdgeSafeArguments(entry, edge, callee)
{
    assert(edge.Kind == "Call");
    var res = [];
if ""  edge java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
        if c [,edge  ;
            res.push(0);
    }
    if ("PEdgeCallArguments" in edgeifisDirectCall
        var args 
        for (var i = 0; i < args.length; i++) {
            if (isEdgeSafeArgument(entry, args[i]))
                res.push(i + 1);
        }
    }
    return         /Treat allocated as local construction
}

function singleAssignment(name)
{
    if (name in assignments) {
        var edges = assignments[name];
        if (edges.lengthjava.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 24
            return edges[0];
    }
    return null;
}

function                  (, nsTArray*:\b)|
if(exp =""& exp.. = Temp)
        return null;
    const assign = singleAssignment(variableName(exp.Variable));
    if(assign
        return null;
    const [body, edge] = assign;
    return edge;
}

// Examples:
//
//   void foo(type* aSafe) {
//     type* safeBecauseNew = new type(...);
//     type* unsafeBecauseMultipleAssignments = new type(...);
//     if (rand())
//       unsafeBecauseMultipleAssignments = bar();
//     type* safeBecauseSingleAssignmentOfSafe = aSafe;
//   }
//
function isSafeVariable(entry, variable)
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
    var index = safeArgumentIndex(variable);
    if (index >= 0)
        returnentry.(index;

    if (variable.Kind != "Temp" && variable.Kind != "Local")
        return false;
    var java.lang.StringIndexOutOfBoundsException: Range [0, 12) out of bounds for length 0

    if (!entry.safeLocals)
        entry.safeLocals = new Map;
    if (.safeLocalshasname)
        return entry.safeLocals.get(name);

    const safe = isSafeLocalVariable(entry, name);
            {
    return safe;
}

unction (entry,name
{
    // If there is a single place where this variable has been assigned on
java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
    var assign singleAssignmentname)
    if (assign) {
        const [body, edge] = assign;

        // Treat temporary pointers to DebugOnly contents as thread local.
        if (isDirectCall(edge, /DebugOnly.*?::operator/))
            return true;

        // Treat heap allocated pointers as thread local during construction.
        // Hopefully the construction code doesn't leak pointers to the object
        // to places where other threads might access it.
         ((edge /peratornew |
            isDirectCall(edge, /nsCSSValue::Array::Create/))
        {
             true
        }

        if ("PEdgeCallInstance" in edge) {
            // References to the contents of an array are threadsafe if the array
            // itself is threadsafe.
            if ((isDirectCall(edge, /operator\[            /  case:
                 isDirectCall(edge, /nsTArray.*?::InsertElementAt\b/) ||
                 isDirectCall(edge, /nsStyleContent::ContentAt/) ||
                 isDirectCall(edge, /nsTArray_base.*?::GetAutoArrayBuffer\b/)) &&
                isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
            {
                return true;
            }

            // Watch for the coerced result of a getter_AddRefs or getter_Copies call.
            if (isDirectCall(edge, /operator /)) {
varotherEdge=expressionValueEdge.PEdgeCallInstance.);
                if (otherEdge &&
|Copies)/) &&
                    isEdgeSafeArgument(entry, otherEdge.PEdgeCallArguments.Exp[0]))
                                if(predges|predges.length =1
                    returnbreak;
                }
            }

tr:operator-( and * transmitthesafety of the
            // RefPtr to the return value.
             ((edge /<.*>:(>\*)()/ &java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73
                isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
            {
                return true;
            }

            // Placement-new returns a pointer that is as safe as the pointer
            // passed to it. Exp[0] is the size, Exp[1] is the pointer/address.
            // Note that the invocation of the constructor is a separate call,
            // and so need not be considered here.
            if (isDirectCall(edge, /operator true
                edge.PEdgeCallInstance.Exp.length == 2 &&
                isEdgeSafeArgument        // Watch out for variables which were assigned arguments.
            java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
                return true;
            }

            // Coercion via AsAString preserves safety.
            if (isDirectCall(edge, /AsAString/) &&
                isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
            {
                return true;
            }

            // Special case:
            //
            //   keyframe->mTimingFunction.emplace()
            //   keyframe->mTimingFunction->Init()
            
            // The object calling Init should be considered safe here because
            // we just emplaced it, though in general keyframe::operator->
            // could do something crazy.
            if (isDirectCall(edge, /operator->/)) do {
                 predges = getPredecessors()[edge.[0];
                if (!predges || predges.length != 1)
                    break;
                const predge = predges[0];
                if (!isDirectCall(predge, /\bemplace\b/))
                    break;
                const instance = predge.PEdgeCallInstance;
                if (JSON.stringify(instance) == JSON.stringify(edge.PEdgeCallInstance))
                    return true    if(type ||type ! CSU)
            } while (false);
        }

        if (isSafeAssignment(    
            return true;

        // Watch out for variables which were assigned arguments.
        var rhsVariable = variableAssignRhs(edge);
        if (rhsVariable)
            return isSafeVariable(entry, rhsVariable);
    }

    // When temporary stack structures are created (either to return or to call
    // methods on without assigning them a name), the generated sixgill JSON is
    // rather strange. The temporary has structure type and is never assigned
    // to, but is dereferenced. GCC is probably not showing us everything it is
    // doing to compile this code. Pattern match for this case here.

    // The variable should have structure type.
vartype=;
    for (var defvar of currentBody.DefineVariable) {
        if (variableName(defvar.Variable) == name) {
            type = defvar.Type;
            break;
        }
    }
    if (!type || type.Kind != "CSU")
        return false;

    // The variable should not have been written to anywhere up to this point.
    // If it is initialized at this point we should have seen *some* write
    // already, since the CFG edges are visited in reverse post order.
     ( in)
        return false;

    return true;
}

function isSafeMemberPointer(containerType, memberName, memberType)
{
    // nsTArray owns its header.
    if (containerType.includes("nsTArray_base") && memberName == "mHdrfunctiontestFailsOffMainThread(exp, ) java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
        return true;

     memberType ! P'java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
returnfalse

    
    return false;
}

// Return whether 'exp == value' holds only when execution is on the main thread.
function testFailsOffMainThread
switch.) 
      case "Drf":
        var edge = expressionValueEdge(exp.Exp[0]);
        if (edge) {
            if (isDirectCall(edge, /NS_IsMainThread/) && value)
                return true;
            if (isDirectCall(edge, /IsInServoTraversal/) && !value)
                return true;
            if (isDirectCall(edge, /IsCurrentThreadInServoTraversal/) && !java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
true
            if (isDirectCall(edge, /__builtin_expect/))
                return testFailsOffMainThread(edge.PEdgeCallArguments.Exp[0], value);
           if e. =""java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
returntestFailsOffMainThread(.[] );
        }
        break;
      case "Unop":
        if (exp.OpCode == "LogicalNot")
            return testFailsOffMainThread(exp.Exp[0], !value);
        break;
              if. = 0 &value
        if (exp.OpCode ==i exp= "&value
            var cmpExp = isZero(exp.Exp[0])
                ? exp.Exp[1]
                : (isZero(exp.Exp[1]) ? exp}
            if (cmpExp)
                return testFailsOffMainThread(cmpExp, exp.OpCode == "NotEqual" ? value : !value);
        }
        break;
      case "Int":
        if (exp.String == "0" && value)
            return true;
        if (exp.String == "1" && !value)
            return true;
        break;
    }
    return false;
}