Scanner: more information about function calls in program output.

When the scanner prints a problem it prints an expression which, ideally
can be evaluated to obtain the problematic object. These expressions had
omitted function argument and 'this' values; now they are present,
though not yet always evaluatable (primitives are supported, but not
objects and functions). Also, try/catch blocks are emitted instead of
the hypothetical "throws" function.

In order to handle 'this' cleanly, each expression generator now also
returns what the this-value would be if the expression were called.
This is used to decide whether .call() is needed.

Future work will be to arrange for more objects to be printed usefully.
One thing that comes to mind is to have a 'global' WeakMap which maps
references that came from e.g. obtainInstance to appropriate
expressions -- rather than adding Contexts to each argument/this.

This is a partial fix for issue 1753,
https://code.google.com/p/google-caja/issues/detail?id=1753

@r5638

[felix8a, 2013-11-25 18:33:51]

https://codereview.appspot.com/31170043/diff/1/tests/com/google/caja/plugin/t...
File tests/com/google/caja/plugin/test-scan-core.js (right):

https://codereview.appspot.com/31170043/diff/1/tests/com/google/caja/plugin/t...
tests/com/google/caja/plugin/test-scan-core.js:421: *     will be the 'this'
value if the expression is called.
I'm a little confused by this description. it reads to me like, "evaluating src
will set this to thisArg", but that doesn't make sense.

It looks to me that thisArg is the value of this while evaluating the outermost
expression in src, so if src is like 'x.y.z' then thisArg will be x.y?

https://codereview.appspot.com/31170043/diff/1/tests/com/google/caja/plugin/t...
File tests/com/google/caja/plugin/test-scan-guest.js (right):

https://codereview.appspot.com/31170043/diff/1/tests/com/google/caja/plugin/t...
tests/com/google/caja/plugin/test-scan-guest.js:1517: c.invocation(2, THIS, [],
false).getProgram());  // TODO unrealistic
TODO(kpreid)

[kpreid2, 2013-11-25 18:49:07]

When the scanner prints a problem it prints an expression which, ideally
can be evaluated to obtain the problematic object. These expressions had
omitted function argument and 'this' values; now they are present,
though not yet always evaluatable (primitives are supported, but not
objects and functions). Also, try/catch blocks are emitted instead of
the hypothetical "throws" function.

In order to handle 'this' cleanly, each expression generator now also
returns what the this-value would be if the expression were called.
This is used to decide whether .call() is needed.

Future work will be to arrange for more objects to be printed usefully.
One thing that comes to mind is to have a 'global' WeakMap which maps
references that came from e.g. obtainInstance to appropriate
expressions -- rather than adding Contexts to each argument/this.

This is a partial fix for issue 1753,
https://code.google.com/p/google-caja/issues/detail?id=1753

[kpreid2, 2013-11-25 18:51:26]

https://codereview.appspot.com/31170043/diff/1/tests/com/google/caja/plugin/t...
File tests/com/google/caja/plugin/test-scan-core.js (right):

https://codereview.appspot.com/31170043/diff/1/tests/com/google/caja/plugin/t...
tests/com/google/caja/plugin/test-scan-core.js:421: *     will be the 'this'
value if the expression is called.
On 2013/11/25 18:33:51, felix8a wrote:
> I'm a little confused by this description. it reads to me like, "evaluating
> src will set this to thisArg", but that doesn't make sense.
> 
> It looks to me that thisArg is the value of this while evaluating the
> outermost expression in src, so if src is like 'x.y.z' then thisArg will be
> x.y?

Yes. "If you add parentheses after this expression, then the 'this' for the
resulting function-call expression will be..."

Rephrased.

https://codereview.appspot.com/31170043/diff/1/tests/com/google/caja/plugin/t...
File tests/com/google/caja/plugin/test-scan-guest.js (right):

https://codereview.appspot.com/31170043/diff/1/tests/com/google/caja/plugin/t...
tests/com/google/caja/plugin/test-scan-guest.js:1517: c.invocation(2, THIS, [],
false).getProgram());  // TODO unrealistic
On 2013/11/25 18:33:51, felix8a wrote:
> TODO(kpreid)

Done. Also tweaked the test cases and another comment.

[felix8a, 2013-11-25 20:21:17]

lgtm

https://codereview.appspot.com/31170043/diff/20001/tests/com/google/caja/plug...
File tests/com/google/caja/plugin/test-scan-core.js (right):

https://codereview.appspot.com/31170043/diff/20001/tests/com/google/caja/plug...
tests/com/google/caja/plugin/test-scan-core.js:428: function makeContext(object,
path, depth, getSelfC, getThisArgC,
the args to this function are starting to get suspiciously complicated, but this
seems ok for now.

https://codereview.appspot.com/31170043/diff/20001/tests/com/google/caja/plug...
File tests/com/google/caja/plugin/test-scan-guest.js (right):

https://codereview.appspot.com/31170043/diff/20001/tests/com/google/caja/plug...
tests/com/google/caja/plugin/test-scan-guest.js:1500: // TODO: Would be better
if there was an abstraction over performing the
TODO(kpreid)