LibJS: Bring Reference records a bit closer to the ECMAScript spec

Our Reference class now has the same fields as the spec:

- Base (a non-nullish value, an environment record, or `unresolvable`)
- Referenced Name (the name of the binding)
- Strict (whether the reference originated in strict mode code)
- ThisValue (if non-empty, the reference represents a `super` keyword)

The main difference from before is that we now resolve the environment
record that a reference interacts with. Previously we simply resolved
to either "local variable" or "global variable".

The associated abstract operations are still largely non-conforming,
since we don't yet implement proper variable bindings. But this patch
should at least fix a handful of test262 cases. :^)

There's one minor regression: some TypeError message strings get
a little worse due to doing a RequireObjectCoercible earlier in the
evaluation of MemberExpression.

Userland/Libraries/LibJS/Runtime/Reference.cpp

@@ -1,9 +1,10 @@
 /*
- * Copyright (c) 2020, Andreas Kling <kling@serenityos.org>
+ * Copyright (c) 2020-2021, Andreas Kling <kling@serenityos.org>
  *
  * SPDX-License-Identifier: BSD-2-Clause
  */
 
+#include <LibJS/AST.h>
 #include <LibJS/Runtime/Error.h>
 #include <LibJS/Runtime/GlobalObject.h>
 #include <LibJS/Runtime/Reference.h>
@@ -15,39 +16,50 @@ void Reference::put(GlobalObject& global_object, Value value)
     auto& vm = global_object.vm();
 
     if (is_unresolvable()) {
-        throw_reference_error(global_object);
+        if (m_strict) {
+            throw_reference_error(global_object);
+            return;
+        }
+        global_object.put(m_name, value);
         return;
     }
 
-    if (is_local_variable() || is_global_variable()) {
-        if (is_local_variable())
-            vm.set_variable(m_name.to_string(), value, global_object);
-        else
-            global_object.put(m_name, value);
+    if (is_property_reference()) {
+        // FIXME: This is an ad-hoc hack until we support proper variable bindings.
+        if (!m_base_value.is_object() && vm.in_strict_mode()) {
+            if (m_base_value.is_nullish())
+                vm.throw_exception<TypeError>(global_object, ErrorType::ReferenceNullishSetProperty, m_name.to_value(vm).to_string_without_side_effects(), m_base_value.to_string_without_side_effects());
+            else
+                vm.throw_exception<TypeError>(global_object, ErrorType::ReferencePrimitiveSetProperty, m_name.to_value(vm).to_string_without_side_effects(), m_base_value.typeof(), m_base_value.to_string_without_side_effects());
+            return;
+        }
+
+        auto* base_obj = m_base_value.to_object(global_object);
+        if (!base_obj)
+            return;
+
+        bool succeeded = base_obj->put(m_name, value);
+        if (!succeeded && m_strict) {
+            vm.throw_exception<TypeError>(global_object, ErrorType::ReferenceNullishSetProperty, m_name.to_value(vm).to_string_without_side_effects(), m_base_value.to_string_without_side_effects());
+            return;
+        }
         return;
     }
 
-    auto base = this->base();
+    VERIFY(m_base_type == BaseType::EnvironmentRecord);
+    auto existing_variable = m_base_environment_record->get_from_environment_record(m_name.as_string());
+    Variable variable {
+        .value = value,
+        .declaration_kind = existing_variable.has_value() ? existing_variable->declaration_kind : DeclarationKind::Var
+    };
 
-    if (!base.is_object() && vm.in_strict_mode()) {
-        if (base.is_nullish())
-            vm.throw_exception<TypeError>(global_object, ErrorType::ReferenceNullishSetProperty, m_name.to_value(vm).to_string_without_side_effects(), base.to_string_without_side_effects());
-        else
-            vm.throw_exception<TypeError>(global_object, ErrorType::ReferencePrimitiveSetProperty, m_name.to_value(vm).to_string_without_side_effects(), base.typeof(), base.to_string_without_side_effects());
+    // FIXME: This is a hack until we support proper variable bindings.
+    if (variable.declaration_kind == DeclarationKind::Const) {
+        vm.throw_exception<TypeError>(global_object, ErrorType::InvalidAssignToConst);
         return;
     }
 
-    if (base.is_nullish()) {
-        // This will always fail the to_object() call below, let's throw the TypeError ourselves with a nice message instead.
-        vm.throw_exception<TypeError>(global_object, ErrorType::ReferenceNullishSetProperty, m_name.to_value(vm).to_string_without_side_effects(), base.to_string_without_side_effects());
-        return;
-    }
-
-    auto* object = base.to_object(global_object);
-    if (!object)
-        return;
-
-    object->put(m_name, value);
+    m_base_environment_record->put_into_environment_record(m_name.as_string(), variable);
 }
 
 void Reference::throw_reference_error(GlobalObject& global_object)
@@ -59,71 +71,92 @@ void Reference::throw_reference_error(GlobalObject& global_object)
         vm.throw_exception<ReferenceError>(global_object, ErrorType::UnknownIdentifier, m_name.to_string_or_symbol().to_display_string());
 }
 
-Value Reference::get(GlobalObject& global_object)
+Value Reference::get(GlobalObject& global_object, bool throw_if_undefined)
 {
-    auto& vm = global_object.vm();
-
     if (is_unresolvable()) {
         throw_reference_error(global_object);
         return {};
     }
 
-    if (is_local_variable() || is_global_variable()) {
-        Value value;
-        if (is_local_variable())
-            value = vm.get_variable(m_name.to_string(), global_object);
-        else
-            value = global_object.get(m_name);
-        if (vm.exception())
-            return {};
-        if (value.is_empty()) {
-            throw_reference_error(global_object);
+    if (is_property_reference()) {
+        auto* base_obj = m_base_value.to_object(global_object);
+        if (!base_obj)
             return {};
+        return base_obj->get(m_name).value_or(js_undefined());
+    }
+
+    VERIFY(m_base_type == BaseType::EnvironmentRecord);
+    auto value = m_base_environment_record->get_from_environment_record(m_name.as_string());
+    if (!value.has_value()) {
+        if (!throw_if_undefined) {
+            // FIXME: This is an ad-hoc hack for the `typeof` operator until we support proper variable bindings.
+            return js_undefined();
         }
-        return value;
-    }
-
-    auto base = this->base();
-
-    if (base.is_nullish()) {
-        // This will always fail the to_object() call below, let's throw the TypeError ourselves with a nice message instead.
-        vm.throw_exception<TypeError>(global_object, ErrorType::ReferenceNullishGetProperty, m_name.to_value(vm).to_string_without_side_effects(), base.to_string_without_side_effects());
+        throw_reference_error(global_object);
         return {};
     }
-
-    auto* object = base.to_object(global_object);
-    if (!object)
-        return {};
-
-    return object->get(m_name).value_or(js_undefined());
+    return value->value;
 }
 
 bool Reference::delete_(GlobalObject& global_object)
 {
-    if (is_unresolvable())
+    if (is_unresolvable()) {
+        VERIFY(!m_strict);
         return true;
+    }
 
     auto& vm = global_object.vm();
 
-    if (is_local_variable() || is_global_variable()) {
-        if (is_local_variable())
-            return vm.delete_variable(m_name.to_string());
+    if (is_property_reference()) {
+        auto* base_obj = m_base_value.to_object(global_object);
+        if (!base_obj)
+            return false;
+        bool succeeded = base_obj->delete_property(m_name);
+        if (!succeeded && m_strict) {
+            vm.throw_exception<TypeError>(global_object, ErrorType::ReferenceNullishDeleteProperty, m_name.to_value(vm).to_string_without_side_effects(), m_base_value.to_string_without_side_effects());
+            return false;
+        }
+        return succeeded;
+    }
+
+    VERIFY(m_base_type == BaseType::EnvironmentRecord);
+    return m_base_environment_record->delete_from_environment_record(m_name.as_string());
+}
+
+String Reference::to_string() const
+{
+    StringBuilder builder;
+    builder.append("Reference { Base=");
+    switch (m_base_type) {
+    case BaseType::Unresolvable:
+        builder.append("Unresolvable");
+        break;
+    case BaseType::EnvironmentRecord:
+        builder.appendff("{}", base_environment().class_name());
+        break;
+    case BaseType::Value:
+        if (m_base_value.is_empty())
+            builder.append("<empty>");
         else
-            return global_object.delete_property(m_name);
+            builder.appendff("{}", m_base_value.to_string_without_side_effects());
+        break;
     }
+    builder.append(", ReferencedName=");
+    if (!m_name.is_valid())
+        builder.append("<invalid>");
+    else if (m_name.is_symbol())
+        builder.appendff("{}", m_name.as_symbol()->to_string());
+    else
+        builder.appendff("{}", m_name.to_string());
+    builder.appendff(", Strict={}", m_strict);
+    builder.appendff(", ThisValue=");
+    if (m_this_value.is_empty())
+        builder.append("<empty>");
+    else
+        builder.appendff("{}", m_this_value.to_string_without_side_effects());
 
-    auto base = this->base();
-
-    if (base.is_nullish()) {
-        // This will always fail the to_object() call below, let's throw the TypeError ourselves with a nice message instead.
-        vm.throw_exception<TypeError>(global_object, ErrorType::ReferenceNullishDeleteProperty, m_name.to_value(vm).to_string_without_side_effects(), base.to_string_without_side_effects());
-        return false;
-    }
-
-    auto* object = base.to_object(global_object);
-    VERIFY(object);
-
-    return object->delete_property(m_name);
+    builder.append(" }");
+    return builder.to_string();
 }
 
 }

Userland/Libraries/LibJS/Runtime/Reference.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, Andreas Kling <kling@serenityos.org>
+ * Copyright (c) 2020-2021, Andreas Kling <kling@serenityos.org>
  *
  * SPDX-License-Identifier: BSD-2-Clause
  */
@@ -7,6 +7,7 @@
 #pragma once
 
 #include <AK/String.h>
+#include <LibJS/Runtime/EnvironmentRecord.h>
 #include <LibJS/Runtime/PropertyName.h>
 #include <LibJS/Runtime/Value.h>
 
@@ -14,69 +15,105 @@ namespace JS {
 
 class Reference {
 public:
+    enum class BaseType : u8 {
+        Unresolvable,
+        Value,
+        EnvironmentRecord,
+    };
+
     Reference() { }
-    Reference(Value base, const PropertyName& name, bool strict = false)
-        : m_base(base)
+    Reference(BaseType type, PropertyName const& name, bool strict)
+        : m_base_type(type)
         , m_name(name)
         , m_strict(strict)
     {
     }
 
-    enum LocalVariableTag { LocalVariable };
-    Reference(LocalVariableTag, const FlyString& name, bool strict = false)
-        : m_base(js_null())
+    Reference(Value base, PropertyName const& name, Value this_value, bool strict = false)
+        : m_base_type(BaseType::Value)
+        , m_base_value(base)
         , m_name(name)
+        , m_this_value(this_value)
+        , m_strict(strict)
+    {
+        if (base.is_nullish()) {
+            m_base_type = BaseType::Unresolvable;
+            m_base_value = {};
+            m_this_value = {};
+            m_name = {};
+        }
+    }
+
+    Reference(EnvironmentRecord& base, FlyString const& referenced_name, bool strict = false)
+        : m_base_type(BaseType::EnvironmentRecord)
+        , m_base_environment_record(&base)
+        , m_name(referenced_name)
         , m_strict(strict)
-        , m_local_variable(true)
     {
     }
 
-    enum GlobalVariableTag { GlobalVariable };
-    Reference(GlobalVariableTag, const FlyString& name, bool strict = false)
-        : m_base(js_null())
-        , m_name(name)
-        , m_strict(strict)
-        , m_global_variable(true)
+    Value base() const
     {
+        VERIFY(m_base_type == BaseType::Value);
+        return m_base_value;
     }
 
-    Value base() const { return m_base; }
-    const PropertyName& name() const { return m_name; }
+    EnvironmentRecord& base_environment() const
+    {
+        VERIFY(m_base_type == BaseType::EnvironmentRecord);
+        return *m_base_environment_record;
+    }
+
+    PropertyName const& name() const { return m_name; }
     bool is_strict() const { return m_strict; }
 
-    bool is_unresolvable() const { return m_base.is_empty(); }
-    bool is_property() const
+    // 6.2.4.2 IsUnresolvableReference ( V ), https://tc39.es/ecma262/#sec-isunresolvablereference
+    bool is_unresolvable() const { return m_base_type == BaseType::Unresolvable; }
+
+    // 6.2.4.1 IsPropertyReference ( V ), https://tc39.es/ecma262/#sec-ispropertyreference
+    bool is_property_reference() const
     {
-        return m_base.is_object() || has_primitive_base();
+        if (is_unresolvable())
+            return false;
+        if (m_base_type == BaseType::EnvironmentRecord)
+            return false;
+        if (m_base_value.is_boolean() || m_base_value.is_string() || m_base_value.is_symbol() || m_base_value.is_bigint() || m_base_value.is_number() || m_base_value.is_object())
+            return true;
+        return false;
     }
 
-    bool has_primitive_base() const
+    // 6.2.4.7 GetThisValue ( V ), https://tc39.es/ecma262/#sec-getthisvalue
+    Value get_this_value() const
     {
-        return m_base.is_boolean() || m_base.is_string() || m_base.is_number();
+        VERIFY(is_property_reference());
+        if (is_super_reference())
+            return m_this_value;
+        return m_base_value;
     }
 
-    bool is_local_variable() const
+    // 6.2.4.3 IsSuperReference ( V ), https://tc39.es/ecma262/#sec-issuperreference
+    bool is_super_reference() const
     {
-        return m_local_variable;
-    }
-
-    bool is_global_variable() const
-    {
-        return m_global_variable;
+        return !m_this_value.is_empty();
     }
 
     void put(GlobalObject&, Value);
-    Value get(GlobalObject&);
+    Value get(GlobalObject&, bool throw_if_undefined = true);
     bool delete_(GlobalObject&);
 
+    String to_string() const;
+
 private:
     void throw_reference_error(GlobalObject&);
 
-    Value m_base;
+    BaseType m_base_type { BaseType::Unresolvable };
+    union {
+        Value m_base_value;
+        EnvironmentRecord* m_base_environment_record;
+    };
     PropertyName m_name;
+    Value m_this_value;
     bool m_strict { false };
-    bool m_local_variable { false };
-    bool m_global_variable { false };
 };
 
 }

Userland/Libraries/LibJS/Runtime/VM.cpp

@@ -393,16 +393,16 @@ Value VM::get_variable(const FlyString& name, GlobalObject& global_object)
 }
 
 // 9.4.2 ResolveBinding ( name [ , env ] ), https://tc39.es/ecma262/#sec-resolvebinding
-Reference VM::resolve_binding(FlyString const& name)
+Reference VM::resolve_binding(GlobalObject& global_object, FlyString const& name, EnvironmentRecord*)
 {
     // FIXME: This implementation of ResolveBinding is non-conforming.
 
     for (auto* environment_record = lexical_environment(); environment_record && environment_record->outer_environment(); environment_record = environment_record->outer_environment()) {
         auto possible_match = environment_record->get_from_environment_record(name);
         if (possible_match.has_value())
-            return { Reference::LocalVariable, name };
+            return Reference { *environment_record, name };
     }
-    return { Reference::GlobalVariable, name };
+    return Reference { global_object.environment_record(), name };
 }
 
 Value VM::construct(Function& function, Function& new_target, Optional<MarkedValueList> arguments)

Userland/Libraries/LibJS/Runtime/VM.h

@@ -204,7 +204,7 @@ public:
     void assign(const FlyString& target, Value, GlobalObject&, bool first_assignment = false, EnvironmentRecord* specific_scope = nullptr);
     void assign(const NonnullRefPtr<BindingPattern>& target, Value, GlobalObject&, bool first_assignment = false, EnvironmentRecord* specific_scope = nullptr);
 
-    Reference resolve_binding(FlyString const&);
+    Reference resolve_binding(GlobalObject&, FlyString const&, EnvironmentRecord* = nullptr);
 
     template<typename T, typename... Args>
     void throw_exception(GlobalObject& global_object, Args&&... args)