From a3f59264b9504e8bf3d0ac70b99a237bc964089d Mon Sep 17 00:00:00 2001

From: Miciah Dashiel Butler Masters <miciah.masters@gmail.com>

Date: Sat, 18 Jul 2009 23:41:01 +0000

Subject: [PATCH 1/4] Heartbeat code using JS_TriggerOperationCallback

Implement new heartbeat code to catch runaway execution of document

ECMAScript code.  The old code uses JS_SetBranchCallback which is

deprecated in new versions of SpiderMonkey.  The new code uses setitimer(2)

and the JS_SetOperationCallback and JS_TriggerOperationCallback interfaces,

introduced in SpiderMonkey 1.8.1.  Compatibility with both the old

JS_SetBranchCallback and the new interfaces is maintained.

Signed-off-by: Kamil Dudka <kdudka@redhat.com>

---

 Makefile.config.in                      |    1 +

 configure.in                            |   12 +++

 src/ecmascript/ecmascript.h             |    4 +

 src/ecmascript/spidermonkey.c           |   38 ++++++++-

 src/ecmascript/spidermonkey/Makefile    |    2 +

 src/ecmascript/spidermonkey/heartbeat.c |  125 +++++++++++++++++++++++++++++++

 src/ecmascript/spidermonkey/heartbeat.h |   24 ++++++

 7 files changed, 201 insertions(+), 5 deletions(-)

 create mode 100644 src/ecmascript/spidermonkey/heartbeat.c

 create mode 100644 src/ecmascript/spidermonkey/heartbeat.h

diff --git a/Makefile.config.in b/Makefile.config.in

index c463868..40a8cd7 100644

--- a/Makefile.config.in

+++ b/Makefile.config.in

@@ -115,6 +115,7 @@ CONFIG_DOC = @CONFIG_DOC@

 CONFIG_DOM = @CONFIG_DOM@

 CONFIG_ECMASCRIPT = @CONFIG_ECMASCRIPT@

 CONFIG_ECMASCRIPT_SMJS = @CONFIG_ECMASCRIPT_SMJS@

+CONFIG_ECMASCRIPT_SMJS_HEARTBEAT = @CONFIG_ECMASCRIPT_SMJS@

 CONFIG_EXMODE = @CONFIG_EXMODE@

 CONFIG_FASTMEM = @CONFIG_FASTMEM@

 CONFIG_FINGER = @CONFIG_FINGER@

diff --git a/configure.in b/configure.in

index f3e3d77..f79ca78 100644

--- a/configure.in

+++ b/configure.in

@@ -283,6 +283,7 @@ AC_CHECK_FUNCS(snprintf vsnprintf asprintf vasprintf)

 AC_CHECK_FUNCS(getifaddrs getpwnam inet_pton inet_ntop)

 AC_CHECK_FUNCS(fflush fsync fseeko ftello sigaction)

 AC_CHECK_FUNCS(gettimeofday clock_gettime)

+AC_CHECK_FUNCS(setitimer, HAVE_SETITIMER=yes)

 AC_CHECK_FUNCS([cygwin_conv_to_full_win32_path])

@@ -603,6 +604,8 @@ AC_MSG_RESULT($cf_result)

 CONFIG_SPIDERMONKEY="$cf_result"

 if test "$cf_result" = "yes"; then

 	AC_CHECK_FUNCS([[JS_ReportAllocationOverflow]])

+	AC_CHECK_FUNCS(JS_SetBranchCallback)

+	AC_CHECK_FUNCS(JS_TriggerOperationCallback, HAVE_JS_TRIGGEROPERATIONCALLBACK=yes)

 fi

 EL_RESTORE_FLAGS

@@ -615,6 +618,15 @@ fi

 EL_CONFIG_DEPENDS(CONFIG_ECMASCRIPT, [CONFIG_ECMASCRIPT_SMJS], [ECMAScript (JavaScript)])

 AC_SUBST(CONFIG_ECMASCRIPT_SMJS)

+if test "x$CONFIG_ECMASCRIPT_SMJS" = xyes &&

+   test "x$HAVE_JS_TRIGGEROPERATIONCALLBACK" = xyes &&

+   test "x$HAVE_SETITIMER" = xyes; then

+	EL_CONFIG(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT, [ECMAScript heartbeat support])

+else

+	CONFIG_ECMASCRIPT_SMJS_HEARTBEAT=no

+fi

+AC_SUBST(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+

 # ===================================================================

 # Optional Spidermonkey-based ECMAScript browser scripting

diff --git a/src/ecmascript/ecmascript.h b/src/ecmascript/ecmascript.h

index e8d84b5..8613b34 100644

--- a/src/ecmascript/ecmascript.h

+++ b/src/ecmascript/ecmascript.h

@@ -33,7 +33,11 @@ struct ecmascript_interpreter {

 	/* The code evaluated by setTimeout() */

 	struct string code;

+#if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+	struct heartbeat *heartbeat;

+#elif defined(HAVE_JS_SETBRANCHCALLBACK)

 	time_t exec_start;

+#endif

 	/* This is a cross-rerenderings accumulator of

 	 * @document.onload_snippets (see its description for juicy details).

diff --git a/src/ecmascript/spidermonkey.c b/src/ecmascript/spidermonkey.c

index 78c3bca..16fb0a4 100644

--- a/src/ecmascript/spidermonkey.c

+++ b/src/ecmascript/spidermonkey.c

@@ -25,6 +25,7 @@

 #include "ecmascript/spidermonkey.h"

 #include "ecmascript/spidermonkey/document.h"

 #include "ecmascript/spidermonkey/form.h"

+#include "ecmascript/spidermonkey/heartbeat.h"

 #include "ecmascript/spidermonkey/location.h"

 #include "ecmascript/spidermonkey/navigator.h"

 #include "ecmascript/spidermonkey/unibar.h"

@@ -109,6 +110,7 @@ reported:

 	JS_ClearPendingException(ctx);

 }

+#if !defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT) && defined(HAVE_JS_SETBRANCHCALLBACK)

 static JSBool

 safeguard(JSContext *ctx, JSScript *script)

 {

@@ -132,6 +134,7 @@ setup_safeguard(struct ecmascript_interpreter *interpreter,

 	interpreter->exec_start = time(NULL);

 	JS_SetBranchCallback(ctx, safeguard);

 }

+#endif

 static void

@@ -172,6 +175,9 @@ spidermonkey_get_interpreter(struct ecmascript_interpreter *interpreter)

 	 * some kind of bytecode cache. (If we will ever do that.) */

 	JS_SetOptions(ctx, JSOPTION_VAROBJFIX | JSOPTION_COMPILE_N_GO);

 	JS_SetErrorReporter(ctx, error_reporter);

+#if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+	JS_SetOperationCallback(ctx, heartbeat_callback);

+#endif

 	window_obj = JS_NewObject(ctx, (JSClass *) &window_class, NULL, NULL);

 	if (!window_obj) goto release_and_fail;

@@ -263,10 +269,17 @@ spidermonkey_eval(struct ecmascript_interpreter *interpreter,

 	assert(interpreter);

 	if (!js_module_init_ok) return;

 	ctx = interpreter->backend_data;

+#if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+	interpreter->heartbeat = add_heartbeat(interpreter);

+#elif defined(HAVE_JS_SETBRANCHCALLBACK)

 	setup_safeguard(interpreter, ctx);

+#endif

 	interpreter->ret = ret;

 	JS_EvaluateScript(ctx, JS_GetGlobalObject(ctx),

 	                  code->source, code->length, "", 0, &rval);

+#if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+	done_heartbeat(interpreter->heartbeat);

+#endif

 }

@@ -274,17 +287,25 @@ unsigned char *

 spidermonkey_eval_stringback(struct ecmascript_interpreter *interpreter,

 			     struct string *code)

 {

+	JSBool ret;

 	JSContext *ctx;

 	jsval rval;

 	assert(interpreter);

 	if (!js_module_init_ok) return NULL;

 	ctx = interpreter->backend_data;

-	setup_safeguard(interpreter, ctx);

 	interpreter->ret = NULL;

-	if (JS_EvaluateScript(ctx, JS_GetGlobalObject(ctx),

-			      code->source, code->length, "", 0, &rval)

-	    == JS_FALSE) {

+#if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+	interpreter->heartbeat = add_heartbeat(interpreter);

+#elif defined(HAVE_JS_SETBRANCHCALLBACK)

+	setup_safeguard(interpreter, ctx);

+#endif

+	ret = JS_EvaluateScript(ctx, JS_GetGlobalObject(ctx),

+	                        code->source, code->length, "", 0, &rval);

+#if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+	done_heartbeat(interpreter->heartbeat);

+#endif

+	if (ret == JS_FALSE) {

 		return NULL;

 	}

 	if (JSVAL_IS_VOID(rval)) {

@@ -308,14 +329,21 @@ spidermonkey_eval_boolback(struct ecmascript_interpreter *interpreter,

 	assert(interpreter);

 	if (!js_module_init_ok) return 0;

 	ctx = interpreter->backend_data;

-	setup_safeguard(interpreter, ctx);

 	interpreter->ret = NULL;

 	fun = JS_CompileFunction(ctx, NULL, "", 0, NULL, code->source,

 				 code->length, "", 0);

 	if (!fun)

 		return -1;

+#if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+	interpreter->heartbeat = add_heartbeat(interpreter);

+#elif defined(HAVE_JS_SETBRANCHCALLBACK)

+	setup_safeguard(interpreter, ctx);

+#endif

 	ret = JS_CallFunction(ctx, NULL, fun, 0, NULL, &rval);

+#if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

+	done_heartbeat(interpreter->heartbeat);

+#endif

 	if (ret == 2) { /* onClick="history.back()" */

 		return 0;

 	}

diff --git a/src/ecmascript/spidermonkey/Makefile b/src/ecmascript/spidermonkey/Makefile

index f1c0fef..377ca80 100644

--- a/src/ecmascript/spidermonkey/Makefile

+++ b/src/ecmascript/spidermonkey/Makefile

@@ -2,6 +2,8 @@ top_builddir=../../..

 include $(top_builddir)/Makefile.config

 INCLUDES += $(SPIDERMONKEY_CFLAGS)

+OBJS-$(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT) += heartbeat.o

+

 OBJS = document.o form.o location.o navigator.o unibar.o window.o

 include $(top_srcdir)/Makefile.lib

diff --git a/src/ecmascript/spidermonkey/heartbeat.c b/src/ecmascript/spidermonkey/heartbeat.c

new file mode 100644

index 0000000..bf95d92

--- /dev/null

+++ b/src/ecmascript/spidermonkey/heartbeat.c

@@ -0,0 +1,125 @@

+/* The SpiderMonkey ECMAScript backend heartbeat fuctionality. */

+

+#ifdef HAVE_CONFIG_H

+#include "config.h"

+#endif

+

+#include <sys/time.h>    /* setitimer(2) */

+

+#include "elinks.h"

+

+#include "ecmascript/spidermonkey/util.h"

+

+#include "config/options.h"

+#include "document/view.h"

+#include "ecmascript/ecmascript.h"

+#include "ecmascript/spidermonkey.h"

+#include "ecmascript/spidermonkey/heartbeat.h"

+#include "osdep/signals.h"

+#include "session/session.h"

+#include "util/lists.h"

+#include "util/math.h"   /* int_upper_bound */

+#include "util/memory.h"

+#include "viewer/text/vs.h"

+

+

+

+static INIT_LIST_OF(struct heartbeat, heartbeats);

+

+static struct itimerval heartbeat_timer = { { 1, 0 }, { 1, 0 } };

+

+

+/* This callback is installed by JS_SetOperationCallback and triggered

+ * by JS_TriggerOperationCallback in the heartbeat code below.  Returning

+ * JS_FALSE terminates script execution immediately. */

+JSBool

+heartbeat_callback(JSContext *ctx)

+{

+        return JS_FALSE;

+}

+

+/* Callback for SIGVTALRM.  Go through all heartbeats, decrease each

+ * one's TTL, and call JS_TriggerOperationCallback if a heartbeat's TTL

+ * goes to 0. */

+static void

+check_heartbeats(void *data)

+{

+        struct heartbeat *hb;

+

+        foreach (hb, heartbeats) {

+		assert(hb->interpreter);

+

+                --hb->ttl;

+

+                if (hb->ttl <= 0) {

+			if (hb->interpreter->vs

+			    && hb->interpreter->vs->doc_view

+			    && hb->interpreter->vs->doc_view->session

+			    && hb->interpreter->vs->doc_view->session->tab

+			    && hb->interpreter->vs->doc_view->session->tab->term) {

+				struct session *ses = hb->interpreter->vs->doc_view->session;

+				struct terminal *term = ses->tab->term;

+				int max_exec_time = get_opt_int("ecmascript.max_exec_time");

+

+				ecmascript_timeout_dialog(term, max_exec_time);

+			}

+

+                        JS_TriggerOperationCallback(hb->interpreter->backend_data);

+                }

+        }

+

+        install_signal_handler(SIGVTALRM, check_heartbeats, NULL, 1);

+}

+

+/* Create a new heartbeat for the given interpreter. */

+struct heartbeat *

+add_heartbeat(struct ecmascript_interpreter *interpreter)

+{

+	struct session *ses;

+        struct heartbeat *hb;

+

+	assert(interpreter);

+

+	if (!interpreter->vs || !interpreter->vs->doc_view)

+		ses = NULL;

+	else

+		ses = interpreter->vs->doc_view->session;

+

+        hb = mem_alloc(sizeof(struct heartbeat));

+        if (!hb) return NULL;

+

+        hb->ttl = get_opt_int("ecmascript.max_exec_time");

+        hb->interpreter = interpreter;

+

+        add_to_list(heartbeats, hb);

+

+        /* Update the heartbeat timer. */

+        if (list_is_singleton(*hb)) {

+                heartbeat_timer.it_value.tv_sec = 1;

+                setitimer(ITIMER_VIRTUAL, &heartbeat_timer, NULL);

+        }

+

+        /* We install the handler every call to add_heartbeat instead of only on

+         * module initialisation because other code may set other handlers for

+         * the signal.  */

+        install_signal_handler(SIGVTALRM, check_heartbeats, NULL, 1);

+

+        return hb;

+}

+

+/* Destroy the given heartbeat. */

+void

+done_heartbeat(struct heartbeat *hb)

+{

+	assert(hb->interpreter);

+

+        /* Stop the heartbeat timer if this heartbeat is the only one. */

+        if (list_is_singleton(*hb)) {

+                heartbeat_timer.it_value.tv_sec = 0;

+                setitimer(ITIMER_VIRTUAL, &heartbeat_timer, NULL);

+        }

+

+        del_from_list(hb);

+        hb->interpreter->heartbeat = NULL;

+        mem_free(hb);

+}

diff --git a/src/ecmascript/spidermonkey/heartbeat.h b/src/ecmascript/spidermonkey/heartbeat.h

new file mode 100644

index 0000000..f7c8b12

--- /dev/null

+++ b/src/ecmascript/spidermonkey/heartbeat.h

@@ -0,0 +1,24 @@

+#ifndef EL__ECMASCRIPT_SPIDERMONKEY_HEARTBEAT_H

+#define EL__ECMASCRIPT_SPIDERMONKEY_HEARTBEAT_H

+

+#include "ecmascript/spidermonkey/util.h"

+

+#include "ecmascript/spidermonkey.h"

+

+struct heartbeat {

+        LIST_HEAD(struct heartbeat);

+

+        int ttl; /* Time to live.  This value is assigned when the

+                  * script begins execution and is decremented every

+                  * second.  When it reaches 0, script execution is

+                  * terminated. */

+

+        struct ecmascript_interpreter *interpreter;

+};

+

+struct heartbeat *add_heartbeat(struct ecmascript_interpreter *interpreter);

+void done_heartbeat(struct heartbeat *hb);

+

+JSBool heartbeat_callback(JSContext *ctx);

+

+#endif

-- 

1.7.4.2

From dcaff5d937d63888c560727dda5f5348fa59a366 Mon Sep 17 00:00:00 2001

From: witekfl <witekfl@poczta.onet.pl>

Date: Tue, 19 Apr 2011 22:41:05 +0200

Subject: [PATCH 2/4] JS_VERSION at least 185 is required for ECMASCript

 (xulrunner-2.0 or later)

The code wasn't tested. It compiles

Signed-off-by: Kamil Dudka <kdudka@redhat.com>

---

 configure.in                            |   10 ++-

 src/ecmascript/spidermonkey-shared.h    |   13 ++-

 src/ecmascript/spidermonkey.c           |   11 +--

 src/ecmascript/spidermonkey/document.c  |   44 ++++----

 src/ecmascript/spidermonkey/form.c      |  192 +++++++++++++++++++++----------

 src/ecmascript/spidermonkey/location.c  |   42 ++++---

 src/ecmascript/spidermonkey/navigator.c |   10 +-

 src/ecmascript/spidermonkey/unibar.c    |   16 ++--

 src/ecmascript/spidermonkey/window.c    |   57 ++++++----

 src/scripting/smjs/action_object.c      |   29 +++--

 src/scripting/smjs/bookmarks.c          |   24 ++--

 src/scripting/smjs/cache_object.c       |   18 ++--

 src/scripting/smjs/core.c               |   11 +-

 src/scripting/smjs/elinks_object.c      |   26 +++--

 src/scripting/smjs/global_object.c      |    6 +-

 src/scripting/smjs/globhist.c           |   22 ++--

 src/scripting/smjs/hooks.c              |    4 +-

 src/scripting/smjs/keybinding.c         |   12 +-

 src/scripting/smjs/load_uri.c           |   10 +-

 src/scripting/smjs/view_state_object.c  |   16 ++--

 20 files changed, 344 insertions(+), 229 deletions(-)

diff --git a/configure.in b/configure.in

index f79ca78..64faf85 100644

--- a/configure.in

+++ b/configure.in

@@ -593,7 +593,15 @@ if test -z "$disable_spidermonkey"; then

 					CPPFLAGS="$CPPFLAGS_X $SPIDERMONKEY_CFLAGS"

 					AC_LINK_IFELSE([AC_LANG_PROGRAM([[#define XP_UNIX

-						     #include <jsapi.h>]], [[JS_GetReservedSlot(NULL, NULL, 0, NULL)]])],[cf_result=yes],[cf_result=no])

+							#define XP_UNIX

+							#include <jsapi.h>]], [[

+							#ifndef JS_VERSION

+							#error JS_VERSION

+							#endif

+							#if JS_VERSION < 185

+							#error too old

+							#endif]])],

+                            [cf_result=yes],[cf_result=no])

 				fi

 			done

 		done

diff --git a/src/ecmascript/spidermonkey-shared.h b/src/ecmascript/spidermonkey-shared.h

index 4cc0eeb..98bfe31 100644

--- a/src/ecmascript/spidermonkey-shared.h

+++ b/src/ecmascript/spidermonkey-shared.h

@@ -50,6 +50,7 @@ JSObject *spidermonkey_InitClass(JSContext *cx, JSObject *obj,

 static void undef_to_jsval(JSContext *ctx, jsval *vp);

 static unsigned char *jsval_to_string(JSContext *ctx, jsval *vp);

+static unsigned char *jsid_to_string(JSContext *ctx, jsid *id);

 /* Inline functions */

@@ -68,7 +69,17 @@ jsval_to_string(JSContext *ctx, jsval *vp)

 		return "";

 	}

-	return empty_string_or_(JS_GetStringBytes(JS_ValueToString(ctx, val)));

+	return empty_string_or_(JS_EncodeString(ctx, JS_ValueToString(ctx, val)));

+}

+

+static inline unsigned char *

+jsid_to_string(JSContext *ctx, jsid *id)

+{

+	jsval v;

+

+	/* TODO: check returned value */

+	JS_IdToValue(ctx, *id, &v);

+	return jsval_to_string(ctx, &v);

 }

 #endif

diff --git a/src/ecmascript/spidermonkey.c b/src/ecmascript/spidermonkey.c

index 16fb0a4..021e6bd 100644

--- a/src/ecmascript/spidermonkey.c

+++ b/src/ecmascript/spidermonkey.c

@@ -167,19 +167,14 @@ spidermonkey_get_interpreter(struct ecmascript_interpreter *interpreter)

 		return NULL;

 	interpreter->backend_data = ctx;

 	JS_SetContextPrivate(ctx, interpreter);

-	/* TODO: Make JSOPTION_STRICT and JSOPTION_WERROR configurable. */

-#ifndef JSOPTION_COMPILE_N_GO

-#define JSOPTION_COMPILE_N_GO 0 /* Older SM versions don't have it. */

-#endif

-	/* XXX: JSOPTION_COMPILE_N_GO will go (will it?) when we implement

-	 * some kind of bytecode cache. (If we will ever do that.) */

-	JS_SetOptions(ctx, JSOPTION_VAROBJFIX | JSOPTION_COMPILE_N_GO);

+	JS_SetOptions(ctx, JSOPTION_VAROBJFIX | JSOPTION_JIT | JSOPTION_METHODJIT);

+	JS_SetVersion(ctx, JSVERSION_LATEST);

 	JS_SetErrorReporter(ctx, error_reporter);

 #if defined(CONFIG_ECMASCRIPT_SMJS_HEARTBEAT)

 	JS_SetOperationCallback(ctx, heartbeat_callback);

 #endif

-	window_obj = JS_NewObject(ctx, (JSClass *) &window_class, NULL, NULL);

+	window_obj = JS_NewCompartmentAndGlobalObject(ctx, (JSClass *) &window_class, NULL);

 	if (!window_obj) goto release_and_fail;

 	if (!JS_InitStandardClasses(ctx, window_obj)) goto release_and_fail;

 	if (!JS_DefineProperties(ctx, window_obj, (JSPropertySpec *) window_props))

diff --git a/src/ecmascript/spidermonkey/document.c b/src/ecmascript/spidermonkey/document.c

index 8f7bb92..dd72aae 100644

--- a/src/ecmascript/spidermonkey/document.c

+++ b/src/ecmascript/spidermonkey/document.c

@@ -47,8 +47,8 @@

 #include "viewer/text/vs.h"

-static JSBool document_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp);

-static JSBool document_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp);

+static JSBool document_get_property(JSContext *ctx, JSObject *obj, jsid id, jsval *vp);

+static JSBool document_set_property(JSContext *ctx, JSObject *obj, jsid id, JSBool strict, jsval *vp);

 /* Each @document_class object must have a @window_class parent.  */

 const JSClass document_class = {

@@ -81,7 +81,7 @@ const JSPropertySpec document_props[] = {

 /* @document_class.getProperty */

 static JSBool

-document_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

+document_get_property(JSContext *ctx, JSObject *obj, jsid id, jsval *vp)

 {

 	JSObject *parent_win;	/* instance of @window_class */

 	struct view_state *vs;

@@ -104,9 +104,9 @@ document_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 	document = doc_view->document;

 	ses = doc_view->session;

-	if (JSVAL_IS_STRING(id)) {

+	if (JSID_IS_STRING(id)) {

 		struct form *form;

-		unsigned char *string = jsval_to_string(ctx, &id;;

+		unsigned char *string = jsid_to_string(ctx, &id;;

 #ifdef CONFIG_COOKIES

 		if (!strcmp(string, "cookie")) {

@@ -135,12 +135,12 @@ document_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 		return JS_TRUE;

 	}

-	if (!JSVAL_IS_INT(id))

+	if (!JSID_IS_INT(id))

 		return JS_TRUE;

 	undef_to_jsval(ctx, vp);

-	switch (JSVAL_TO_INT(id)) {

+	switch (JSID_TO_INT(id)) {

 	case JSP_DOC_LOC:

 		JS_GetProperty(ctx, parent_win, "location", vp);

 		break;

@@ -188,7 +188,7 @@ document_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 /* @document_class.setProperty */

 static JSBool

-document_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

+document_set_property(JSContext *ctx, JSObject *obj, jsid id, JSBool strict, jsval *vp)

 {

 	JSObject *parent_win;	/* instance of @window_class */

 	struct view_state *vs;

@@ -209,9 +209,9 @@ document_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 	doc_view = vs->doc_view;

 	document = doc_view->document;

-	if (JSVAL_IS_STRING(id)) {

+	if (JSID_IS_STRING(id)) {

 #ifdef CONFIG_COOKIES

-		if (!strcmp(jsval_to_string(ctx, &id), "cookie")) {

+		if (!strcmp(jsid_to_string(ctx, &id), "cookie")) {

 			set_cookie(vs->uri, jsval_to_string(ctx, vp));

 			/* Do NOT touch our .cookie property, evil

 			 * SpiderMonkey!! */

@@ -221,10 +221,10 @@ document_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 		return JS_TRUE;

 	}

-	if (!JSVAL_IS_INT(id))

+	if (!JSID_IS_INT(id))

 		return JS_TRUE;

-	switch (JSVAL_TO_INT(id)) {

+	switch (JSID_TO_INT(id)) {

 	case JSP_DOC_TITLE:

 		mem_free_set(&document->title, stracpy(jsval_to_string(ctx, vp)));

 		print_screen_status(doc_view->session);

@@ -242,8 +242,8 @@ document_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 	return JS_TRUE;

 }

-static JSBool document_write(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval);

-static JSBool document_writeln(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval);

+static JSBool document_write(JSContext *ctx, uintN argc, jsval *rval);

+static JSBool document_writeln(JSContext *ctx, uintN argc, jsval *rval);

 const spidermonkeyFunctionSpec document_funcs[] = {

 	{ "write",		document_write,		1 },

@@ -252,11 +252,12 @@ const spidermonkeyFunctionSpec document_funcs[] = {

 };

 static JSBool

-document_write_do(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv,

-                  jsval *rval, int newline)

+document_write_do(JSContext *ctx, uintN argc, jsval *rval, int newline)

 {

+	jsval val;

 	struct ecmascript_interpreter *interpreter = JS_GetContextPrivate(ctx);

 	struct string *ret = interpreter->ret;

+	jsval *argv = JS_ARGV(ctx, rval);

 	if (argc >= 1 && ret) {

 		int i = 0;

@@ -281,22 +282,23 @@ document_write_do(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv,

 	set_led_value(interpreter->vs->doc_view->session->status.ecmascript_led, 'J');

 #endif

-	boolean_to_jsval(ctx, rval, 0);

+	boolean_to_jsval(ctx, &val, 0);

+	JS_SET_RVAL(ctx, rval, val);

 	return JS_TRUE;

 }

 /* @document_funcs{"write"} */

 static JSBool

-document_write(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)

+document_write(JSContext *ctx, uintN argc, jsval *rval)

 {

-	return document_write_do(ctx, obj, argc, argv, rval, 0);

+	return document_write_do(ctx, argc, rval, 0);

 }

 /* @document_funcs{"writeln"} */

 static JSBool

-document_writeln(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)

+document_writeln(JSContext *ctx, uintN argc, jsval *rval)

 {

-	return document_write_do(ctx, obj, argc, argv, rval, 1);

+	return document_write_do(ctx, argc, rval, 1);

 }

diff --git a/src/ecmascript/spidermonkey/form.c b/src/ecmascript/spidermonkey/form.c

index ff436a1..824b170 100644

--- a/src/ecmascript/spidermonkey/form.c

+++ b/src/ecmascript/spidermonkey/form.c

@@ -55,8 +55,8 @@ static const JSClass form_class;	     /* defined below */

  * HTMLInputElement. The difference could be spotted only by some clever tricky

  * JS code, but I hope it doesn't matter anywhere. --pasky */

-static JSBool input_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp);

-static JSBool input_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp);

+static JSBool input_get_property(JSContext *ctx, JSObject *obj, jsid id, jsval *vp);

+static JSBool input_set_property(JSContext *ctx, JSObject *obj, jsid id, JSBool strict, jsval *vp);

 static void input_finalize(JSContext *ctx, JSObject *obj);

 /* Each @input_class object must have a @form_class parent.  */

@@ -116,10 +116,10 @@ static const JSPropertySpec input_props[] = {

 	{ NULL }

 };

-static JSBool input_blur(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval);

-static JSBool input_click(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval);

-static JSBool input_focus(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval);

-static JSBool input_select(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval);

+static JSBool input_blur(JSContext *ctx, uintN argc, jsval *rval);

+static JSBool input_click(JSContext *ctx, uintN argc, jsval *rval);

+static JSBool input_focus(JSContext *ctx, uintN argc, jsval *rval);

+static JSBool input_select(JSContext *ctx, uintN argc, jsval *rval);

 static const spidermonkeyFunctionSpec input_funcs[] = {

 	{ "blur",	input_blur,	0 },

@@ -150,7 +150,7 @@ input_get_form_state(JSContext *ctx, JSObject *jsinput)

 /* @input_class.getProperty */

 static JSBool

-input_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

+input_get_property(JSContext *ctx, JSObject *obj, jsid id, jsval *vp)

 {

 	JSObject *parent_form;	/* instance of @form_class */

 	JSObject *parent_doc;	/* instance of @document_class */

@@ -189,7 +189,7 @@ input_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 	assert(fc);

 	assert(fc->form && fs);

-	if (!JSVAL_IS_INT(id))

+	if (!JSID_IS_INT(id))

 		return JS_TRUE;

 	linknum = get_form_control_link(document, fc);

@@ -198,7 +198,7 @@ input_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 	undef_to_jsval(ctx, vp);

-	switch (JSVAL_TO_INT(id)) {

+	switch (JSID_TO_INT(id)) {

 	case JSP_INPUT_ACCESSKEY:

 	{

 		JSString *keystr;

@@ -301,7 +301,7 @@ input_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 /* @input_class.setProperty */

 static JSBool

-input_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

+input_set_property(JSContext *ctx, JSObject *obj, jsid id, JSBool strict, jsval *vp)

 {

 	JSObject *parent_form;	/* instance of @form_class */

 	JSObject *parent_doc;	/* instance of @document_class */

@@ -341,14 +341,14 @@ input_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 	assert(fc);

 	assert(fc->form && fs);

-	if (!JSVAL_IS_INT(id))

+	if (!JSID_IS_INT(id))

 		return JS_TRUE;

 	linknum = get_form_control_link(document, fc);

 	/* Hiddens have no link. */

 	if (linknum >= 0) link = &document->links[linknum];

-	switch (JSVAL_TO_INT(id)) {

+	switch (JSID_TO_INT(id)) {

 	case JSP_INPUT_ACCESSKEY:

 		accesskey = jsval_to_accesskey(ctx, vp);

 		if (accesskey == UCS_NO_CHAR)

@@ -422,7 +422,7 @@ input_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)

 /* @input_funcs{"blur"} */

 static JSBool

-input_blur(JSContext *ctx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)

+input_blur(JSContext *ctx, uintN argc, jsval *rval)

 {

 	/* We are a text-mode browser and there *always* has to be something