verifier: Implemented unsafe class lookup.

The verifier bakes in the object that it finds the class defined on (a global object) to avoid calls to find property. It is 'unsafe' because it may crash in some corner cases, however it passes all the current tests.

src/avm2/bin/numbers.js

@@ -176,6 +176,10 @@ if (configurationSet.value.indexOf("v") >= 0) {
   configurations.push({name: "shu-v", timeout: timeout.value, command: commandPrefix + " -x -opt -verify" + commandSuffix});
 }
 
+if (configurationSet.value.indexOf("u") >= 0) {
+  configurations.push({name: "shu-u", timeout: timeout.value, command: commandPrefix + " -x -opt -verify -unsafelookup" + commandSuffix});
+}
+
 console.log(padRight("=== Configurations ", "=", 120));
 configurations.forEach(function (x) {
   console.log(padLeft(x.name, ' ', 10) + ", timeout: " + (x.timeout / 1000).toFixed(2) + ", command: " + x.command);
@@ -325,7 +329,7 @@ function runNextTest () {
           } else {
             someFailed = true;
             var nPassed = 0, nFailed = 0, nPassedPercentage = 1;
-            if (result.output.text) {
+            if (result.output.text && baseline.output.text) {
               var match = result.output.text.match(/PASSED/g);
               nPassed = match ? match.length : 0;
               match = baseline.output.text.match(/PASSED/g);

src/avm2/bin/tamarin.i.c.o.v.passed

@@ -1041,8 +1041,6 @@
 ../tests/tamarin/as3/AbcDecoder/impClass.abc
 ../tests/tamarin/as3/AbcDecoder/extClass.abc
 ../tests/tamarin/as3/AbcDecoder/accessSpecifiers.abc
-../tests/tamarin/regress/bug_460872.abc
-
  ../tests/tamarin/regress/bug_460872.abc
  ../tests/tamarin/spidermonkey/js1_5/Regress/regress-417893.abc                                                                                
  ../tests/tamarin/spidermonkey/js1_5/Regress/regress-360969-01.abc                                                                             

src/avm2/compiler/compiler.js

@@ -1,6 +1,7 @@
 var compilerOptions = systemOptions.register(new OptionSet("Compiler Options"));
 var enableOpt = compilerOptions.register(new Option("opt", "optimizations", "boolean", false, "Enable optimizations."));
 var enableVerifier = compilerOptions.register(new Option("verify", "verify", "boolean", false, "Enable verifier."));
+var enableUnsafeScopeLookup = compilerOptions.register(new Option("unsafelookup", "unsafelookup", "boolean", false, "Enable unsafe scope lookup."));
 var enableInlineCaching = compilerOptions.register(new Option("ic", "inlineCaching", "boolean", false, "Enable inline caching."));
 var traceInlineCaching = compilerOptions.register(new Option("tic", "traceInlineCaching", "boolean", false, "Trace inline caching execution."));
 
@@ -196,6 +197,7 @@ var Compiler = (function () {
                 value instanceof Array ||
                 value instanceof CatchScopeObject ||
                 value instanceof Scope ||
+                value instanceof Global ||
                 value.forceConstify === true,
                 "Should not make constants from ", value);
         MemberExpression.call(this, constantsName, new Literal(objectId(value)), true);
@@ -1087,6 +1089,11 @@ var Compiler = (function () {
        * Find the scope object containing the specified multiname.
        */
       function findProperty(multiname, strict) {
+        if (enableUnsafeScopeLookup.value) {
+          if (bc.foundObj) {
+              return constant(bc.foundObj);
+          }
+        }
         return cseValue(new FindProperty(multiname, constant(abc.domain), strict));
       }
 

src/avm2/compiler/verifier.js

@@ -745,12 +745,19 @@ var Verifier = (function() {
 
           // the property was not found in the scope stack, search the saved scope
           if (savedScope) {
-            obj = savedScope.findProperty(multiname, domain, false);
+            var obj = savedScope.findProperty(multiname, domain, false);
 
             if (obj instanceof domain.system.Class || obj instanceof Interface) {
               return Type.fromClass(obj);
-            } else if (obj instanceof Global || obj instanceof Activation) {
+            } else if (obj instanceof Activation) {
               return Type.fromReference(obj);
+            } else if (obj instanceof Global) {
+              var objTy = Type.fromReference(obj);
+              var trait = objTy.getTraitEnforceGetter(multiname);
+              if (trait && trait.isClass()) {
+                bc.foundObj = obj;
+              }
+              return objTy;
             }
             // TODO - we cannot deal with object instances found on the scope stack
             // like in case of function instances; see ../tests/tamarin/ecma3/Array/splice2.abc