blob: 37a75b5570be26d60f630d98174dd199265d3bd5 [file] [log] [blame]
/*
* Copyright (C) 2008-2021 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#pragma once
#include "ClassInfo.h"
#include "ConcurrentJSLock.h"
#include "DeletePropertySlot.h"
#include "IndexingType.h"
#include "JSCJSValue.h"
#include "JSCast.h"
#include "JSType.h"
#include "JSTypeInfo.h"
#include "PropertyName.h"
#include "PropertyNameArray.h"
#include "PropertyOffset.h"
#include "PutPropertySlot.h"
#include "StructureIDBlob.h"
#include "StructureRareData.h"
#include "StructureTransitionTable.h"
#include "TinyBloomFilter.h"
#include "Watchpoint.h"
#include "WriteBarrierInlines.h"
#include <wtf/Atomics.h>
#include <wtf/PrintStream.h>
namespace WTF {
class UniquedStringImpl;
} // namespace WTF
namespace JSC {
class DeferGC;
class DeferredStructureTransitionWatchpointFire;
class LLIntOffsetsExtractor;
class PropertyNameArray;
class PropertyNameArrayData;
class PropertyTable;
class StructureChain;
class StructureShape;
class JSString;
struct DumpContext;
struct HashTable;
struct HashTableValue;
// The out-of-line property storage capacity to use when first allocating out-of-line
// storage. Note that all objects start out without having any out-of-line storage;
// this comes into play only on the first property store that exhausts inline storage.
static constexpr unsigned initialOutOfLineCapacity = 4;
// The factor by which to grow out-of-line storage when it is exhausted, after the
// initial allocation.
static constexpr unsigned outOfLineGrowthFactor = 2;
struct PropertyMapEntry {
UniquedStringImpl* key;
PropertyOffset offset;
uint8_t attributes;
PropertyMapEntry()
: key(nullptr)
, offset(invalidOffset)
, attributes(0)
{
}
PropertyMapEntry(UniquedStringImpl* key, PropertyOffset offset, unsigned attributes)
: key(key)
, offset(offset)
, attributes(attributes)
{
ASSERT(this->attributes == attributes);
}
};
class StructureFireDetail final : public FireDetail {
public:
StructureFireDetail(const Structure* structure)
: m_structure(structure)
{
}
void dump(PrintStream& out) const final;
private:
const Structure* m_structure;
};
class Structure : public JSCell {
static constexpr uint16_t shortInvalidOffset = std::numeric_limits<uint16_t>::max() - 1;
static constexpr uint16_t useRareDataFlag = std::numeric_limits<uint16_t>::max();
public:
friend class StructureTransitionTable;
typedef JSCell Base;
static constexpr unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
enum PolyProtoTag { PolyProto };
static Structure* create(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType = NonArray, unsigned inlineCapacity = 0);
static Structure* create(PolyProtoTag, VM&, JSGlobalObject*, JSObject* prototype, const TypeInfo&, const ClassInfo*, IndexingType = NonArray, unsigned inlineCapacity = 0);
~Structure();
template<typename CellType, SubspaceAccess>
static IsoSubspace* subspaceFor(VM& vm)
{
return &vm.structureSpace();
}
JS_EXPORT_PRIVATE static bool isValidPrototype(JSValue);
protected:
void finishCreation(VM& vm, const Structure* previous)
{
this->finishCreation(vm);
if (previous->hasRareData()) {
const StructureRareData* previousRareData = previous->rareData();
if (previousRareData->hasSharedPolyProtoWatchpoint()) {
ensureRareData(vm);
rareData()->setSharedPolyProtoWatchpoint(previousRareData->copySharedPolyProtoWatchpoint());
}
}
}
private:
void finishCreation(VM& vm)
{
Base::finishCreation(vm);
ASSERT(m_prototype.get().isEmpty() || isValidPrototype(m_prototype.get()));
}
void finishCreation(VM& vm, CreatingEarlyCellTag)
{
Base::finishCreation(vm, this, CreatingEarlyCell);
ASSERT(m_prototype);
ASSERT(m_prototype.isNull());
ASSERT(!vm.structureStructure);
}
void validateFlags();
public:
StructureID id() const { return m_blob.structureID(); }
int32_t objectInitializationBlob() const { return m_blob.blobExcludingStructureID(); }
int64_t idBlob() const { return m_blob.blob(); }
bool isProxy() const
{
JSType type = m_blob.type();
return type == PureForwardingProxyType || type == ProxyObjectType;
}
static void dumpStatistics();
JS_EXPORT_PRIVATE static Structure* addPropertyTransition(VM&, Structure*, PropertyName, unsigned attributes, PropertyOffset&);
JS_EXPORT_PRIVATE static Structure* addNewPropertyTransition(VM&, Structure*, PropertyName, unsigned attributes, PropertyOffset&, PutPropertySlot::Context = PutPropertySlot::UnknownContext, DeferredStructureTransitionWatchpointFire* = nullptr);
static Structure* addPropertyTransitionToExistingStructureConcurrently(Structure*, UniquedStringImpl* uid, unsigned attributes, PropertyOffset&);
static Structure* addPropertyTransitionToExistingStructure(Structure*, PropertyName, unsigned attributes, PropertyOffset&);
static Structure* removeNewPropertyTransition(VM&, Structure*, PropertyName, PropertyOffset&, DeferredStructureTransitionWatchpointFire* = nullptr);
static Structure* removePropertyTransition(VM&, Structure*, PropertyName, PropertyOffset&, DeferredStructureTransitionWatchpointFire* = nullptr);
static Structure* removePropertyTransitionFromExistingStructure(Structure*, PropertyName, PropertyOffset&);
static Structure* removePropertyTransitionFromExistingStructureConcurrently(Structure*, PropertyName, PropertyOffset&);
static Structure* changePrototypeTransition(VM&, Structure*, JSValue prototype, DeferredStructureTransitionWatchpointFire&);
JS_EXPORT_PRIVATE static Structure* attributeChangeTransition(VM&, Structure*, PropertyName, unsigned attributes, DeferredStructureTransitionWatchpointFire* = nullptr);
JS_EXPORT_PRIVATE static Structure* attributeChangeTransitionToExistingStructure(Structure*, PropertyName, unsigned attributes, PropertyOffset&);
JS_EXPORT_PRIVATE static Structure* toCacheableDictionaryTransition(VM&, Structure*, DeferredStructureTransitionWatchpointFire* = nullptr);
static Structure* toUncacheableDictionaryTransition(VM&, Structure*, DeferredStructureTransitionWatchpointFire* = nullptr);
JS_EXPORT_PRIVATE static Structure* sealTransition(VM&, Structure*);
JS_EXPORT_PRIVATE static Structure* freezeTransition(VM&, Structure*);
static Structure* preventExtensionsTransition(VM&, Structure*);
static Structure* nonPropertyTransition(VM&, Structure*, TransitionKind);
JS_EXPORT_PRIVATE static Structure* nonPropertyTransitionSlow(VM&, Structure*, TransitionKind);
static Structure* setBrandTransitionFromExistingStructureConcurrently(Structure*, UniquedStringImpl*);
static Structure* setBrandTransition(VM&, Structure*, Symbol* brand, DeferredStructureTransitionWatchpointFire* = nullptr);
JS_EXPORT_PRIVATE bool isSealed(VM&);
JS_EXPORT_PRIVATE bool isFrozen(VM&);
bool isStructureExtensible() const { return !didPreventExtensions(); }
JS_EXPORT_PRIVATE Structure* flattenDictionaryStructure(VM&, JSObject*);
static constexpr bool needsDestruction = true;
static void destroy(JSCell*);
// Versions that take a func will call it after making the change but while still holding
// the lock. The callback is not called if there is no change being made, like if you call
// removePropertyWithoutTransition() and the property is not found.
template<typename Func>
PropertyOffset addPropertyWithoutTransition(VM&, PropertyName, unsigned attributes, const Func&);
template<typename Func>
PropertyOffset removePropertyWithoutTransition(VM&, PropertyName, const Func&);
template<typename Func>
PropertyOffset attributeChangeWithoutTransition(VM&, PropertyName, unsigned attributes, const Func&);
void setPrototypeWithoutTransition(VM&, JSValue prototype);
bool isDictionary() const { return dictionaryKind() != NoneDictionaryKind; }
bool isUncacheableDictionary() const { return dictionaryKind() == UncachedDictionaryKind; }
bool prototypeQueriesAreCacheable()
{
return !typeInfo().prohibitsPropertyCaching();
}
bool propertyAccessesAreCacheable()
{
return dictionaryKind() != UncachedDictionaryKind
&& prototypeQueriesAreCacheable()
&& !(typeInfo().getOwnPropertySlotIsImpure() && !typeInfo().newImpurePropertyFiresWatchpoints());
}
bool propertyAccessesAreCacheableForAbsence()
{
return !typeInfo().getOwnPropertySlotIsImpureForPropertyAbsence();
}
bool needImpurePropertyWatchpoint()
{
return propertyAccessesAreCacheable()
&& typeInfo().getOwnPropertySlotIsImpure()
&& typeInfo().newImpurePropertyFiresWatchpoints();
}
bool isImmutablePrototypeExoticObject()
{
return typeInfo().isImmutablePrototypeExoticObject();
}
// We use SlowPath in GetByStatus for structures that may get new impure properties later to prevent
// DFG from inlining property accesses since structures don't transition when a new impure property appears.
bool takesSlowPathInDFGForImpureProperty()
{
return typeInfo().getOwnPropertySlotIsImpure();
}
bool hasNonReifiedStaticProperties() const
{
return typeInfo().hasStaticPropertyTable() && !staticPropertiesReified();
}
// Type accessors.
TypeInfo typeInfo() const { return m_blob.typeInfo(m_outOfLineTypeFlags); }
bool isObject() const { return typeInfo().isObject(); }
protected:
// You probably want typeInfo().type()
JSType type() { return JSCell::type(); }
public:
IndexingType indexingType() const { return m_blob.indexingModeIncludingHistory() & AllWritableArrayTypes; }
IndexingType indexingMode() const { return m_blob.indexingModeIncludingHistory() & AllArrayTypes; }
Dependency fencedIndexingMode(IndexingType& indexingType)
{
Dependency dependency = m_blob.fencedIndexingModeIncludingHistory(indexingType);
indexingType &= AllArrayTypes;
return dependency;
}
IndexingType indexingModeIncludingHistory() const { return m_blob.indexingModeIncludingHistory(); }
inline bool mayInterceptIndexedAccesses() const;
bool holesMustForwardToPrototype(VM&, JSObject*) const;
JSGlobalObject* globalObject() const { return m_globalObject.get(); }
// NOTE: This method should only be called during the creation of structures, since the global
// object of a structure is presumed to be immutable in a bunch of places.
void setGlobalObject(VM&, JSGlobalObject*);
ALWAYS_INLINE bool hasMonoProto() const
{
return !m_prototype.get().isEmpty();
}
ALWAYS_INLINE bool hasPolyProto() const
{
return !hasMonoProto();
}
ALWAYS_INLINE JSValue storedPrototype() const
{
ASSERT(hasMonoProto());
return m_prototype.get();
}
JSValue storedPrototype(const JSObject*) const;
JSObject* storedPrototypeObject(const JSObject*) const;
Structure* storedPrototypeStructure(const JSObject*) const;
JSObject* storedPrototypeObject() const;
Structure* storedPrototypeStructure() const;
JSValue prototypeForLookup(JSGlobalObject*) const;
JSValue prototypeForLookup(JSGlobalObject*, JSCell* base) const;
StructureChain* prototypeChain(VM&, JSGlobalObject*, JSObject* base) const;
DECLARE_VISIT_CHILDREN;
// A Structure is cheap to mark during GC if doing so would only add a small and bounded amount
// to our heap footprint. For example, if the structure refers to a global object that is not
// yet marked, then as far as we know, the decision to mark this Structure would lead to a large
// increase in footprint because no other object refers to that global object. This method
// returns true if all user-controlled (and hence unbounded in size) objects referenced from the
// Structure are already marked.
template<typename Visitor> bool isCheapDuringGC(Visitor&);
// Returns true if this structure is now marked.
template<typename Visitor> bool markIfCheap(Visitor&);
bool hasRareData() const
{
return isRareData(m_previousOrRareData.get());
}
StructureRareData* rareData()
{
ASSERT(hasRareData());
return static_cast<StructureRareData*>(m_previousOrRareData.get());
}
StructureRareData* tryRareData()
{
JSCell* value = m_previousOrRareData.get();
WTF::dependentLoadLoadFence();
if (isRareData(value))
return static_cast<StructureRareData*>(value);
return nullptr;
}
const StructureRareData* rareData() const
{
ASSERT(hasRareData());
return static_cast<const StructureRareData*>(m_previousOrRareData.get());
}
const StructureRareData* rareDataConcurrently() const
{
JSCell* cell = m_previousOrRareData.get();
if (isRareData(cell))
return static_cast<StructureRareData*>(cell);
return nullptr;
}
StructureRareData* ensureRareData(VM& vm)
{
if (!hasRareData())
allocateRareData(vm);
return rareData();
}
Structure* previousID() const
{
ASSERT(structure()->classInfo() == info());
// This is so written because it's used concurrently. We only load from m_previousOrRareData
// once, and this load is guaranteed atomic.
JSCell* cell = m_previousOrRareData.get();
if (isRareData(cell))
return static_cast<StructureRareData*>(cell)->previousID();
return static_cast<Structure*>(cell);
}
bool transitivelyTransitionedFrom(Structure* structureToFind);
PropertyOffset maxOffset() const
{
uint16_t maxOffset = m_maxOffset;
if (maxOffset == shortInvalidOffset)
return invalidOffset;
if (maxOffset == useRareDataFlag)
return rareData()->m_maxOffset;
return maxOffset;
}
void setMaxOffset(VM& vm, PropertyOffset offset)
{
if (offset == invalidOffset)
m_maxOffset = shortInvalidOffset;
else if (offset < useRareDataFlag && offset < shortInvalidOffset)
m_maxOffset = offset;
else if (m_maxOffset == useRareDataFlag)
rareData()->m_maxOffset = offset;
else {
ensureRareData(vm)->m_maxOffset = offset;
WTF::storeStoreFence();
m_maxOffset = useRareDataFlag;
}
}
PropertyOffset transitionOffset() const
{
uint16_t transitionOffset = m_transitionOffset;
if (transitionOffset == shortInvalidOffset)
return invalidOffset;
if (transitionOffset == useRareDataFlag)
return rareData()->m_transitionOffset;
return transitionOffset;
}
void setTransitionOffset(VM& vm, PropertyOffset offset)
{
if (offset == invalidOffset)
m_transitionOffset = shortInvalidOffset;
else if (offset < useRareDataFlag && offset < shortInvalidOffset)
m_transitionOffset = offset;
else if (m_transitionOffset == useRareDataFlag)
rareData()->m_transitionOffset = offset;
else {
ensureRareData(vm)->m_transitionOffset = offset;
WTF::storeStoreFence();
m_transitionOffset = useRareDataFlag;
}
}
static unsigned outOfLineCapacity(PropertyOffset maxOffset)
{
unsigned outOfLineSize = Structure::outOfLineSize(maxOffset);
// This algorithm completely determines the out-of-line property storage growth algorithm.
// The JSObject code will only trigger a resize if the value returned by this algorithm
// changed between the new and old structure. So, it's important to keep this simple because
// it's on a fast path.
if (!outOfLineSize)
return 0;
if (outOfLineSize <= initialOutOfLineCapacity)
return initialOutOfLineCapacity;
ASSERT(outOfLineSize > initialOutOfLineCapacity);
COMPILE_ASSERT(outOfLineGrowthFactor == 2, outOfLineGrowthFactor_is_two);
return WTF::roundUpToPowerOfTwo(outOfLineSize);
}
static unsigned outOfLineSize(PropertyOffset maxOffset)
{
return numberOfOutOfLineSlotsForMaxOffset(maxOffset);
}
unsigned outOfLineCapacity() const
{
return outOfLineCapacity(maxOffset());
}
unsigned outOfLineSize() const
{
return outOfLineSize(maxOffset());
}
bool hasInlineStorage() const
{
return !!m_inlineCapacity;
}
unsigned inlineCapacity() const
{
return m_inlineCapacity;
}
unsigned inlineSize() const
{
return std::min<unsigned>(maxOffset() + 1, m_inlineCapacity);
}
unsigned totalStorageCapacity() const
{
ASSERT(structure()->classInfo() == info());
return outOfLineCapacity() + inlineCapacity();
}
bool isValidOffset(PropertyOffset offset) const
{
return JSC::isValidOffset(offset)
&& offset <= maxOffset()
&& (offset < m_inlineCapacity || offset >= firstOutOfLineOffset);
}
bool hijacksIndexingHeader() const
{
return isTypedView(m_classInfo->typedArrayStorageType);
}
bool couldHaveIndexingHeader() const
{
return hasIndexedProperties(indexingType())
|| hijacksIndexingHeader();
}
bool hasIndexingHeader(const JSCell*) const;
bool masqueradesAsUndefined(JSGlobalObject* lexicalGlobalObject);
PropertyOffset get(VM&, PropertyName);
PropertyOffset get(VM&, PropertyName, unsigned& attributes);
// This is a somewhat internalish method. It will call your functor while possibly holding the
// Structure's lock. There is no guarantee whether the lock is held or not in any particular
// call. So, you have to assume the worst. Also, the functor returns true if it wishes for you
// to continue or false if it's done.
template<typename Functor>
void forEachPropertyConcurrently(const Functor&);
template<typename Functor>
void forEachProperty(VM&, const Functor&);
PropertyOffset getConcurrently(UniquedStringImpl* uid);
PropertyOffset getConcurrently(UniquedStringImpl* uid, unsigned& attributes);
Vector<PropertyMapEntry> getPropertiesConcurrently();
void setHasGetterSetterPropertiesWithProtoCheck(bool is__proto__)
{
setHasGetterSetterProperties(true);
if (!is__proto__)
setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
}
void setContainsReadOnlyProperties() { setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true); }
void setHasCustomGetterSetterPropertiesWithProtoCheck(bool is__proto__)
{
setHasCustomGetterSetterProperties(true);
if (!is__proto__)
setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
}
void setCachedPropertyNameEnumerator(VM&, JSPropertyNameEnumerator*, StructureChain*);
JSPropertyNameEnumerator* cachedPropertyNameEnumerator() const;
uintptr_t cachedPropertyNameEnumeratorAndFlag() const;
bool canCachePropertyNameEnumerator(VM&) const;
bool canAccessPropertiesQuicklyForEnumeration() const;
JSImmutableButterfly* cachedPropertyNames(CachedPropertyNamesKind) const;
JSImmutableButterfly* cachedPropertyNamesIgnoringSentinel(CachedPropertyNamesKind) const;
void setCachedPropertyNames(VM&, CachedPropertyNamesKind, JSImmutableButterfly*);
bool canCacheOwnPropertyNames() const;
void getPropertyNamesFromStructure(VM&, PropertyNameArray&, DontEnumPropertiesMode);
JSValue cachedSpecialProperty(CachedSpecialPropertyKey key)
{
if (!hasRareData())
return JSValue();
return rareData()->cachedSpecialProperty(key);
}
void cacheSpecialProperty(JSGlobalObject*, VM&, JSValue, CachedSpecialPropertyKey, const PropertySlot&);
const ClassInfo* classInfo() const { return m_classInfo; }
static ptrdiff_t structureIDOffset()
{
return OBJECT_OFFSETOF(Structure, m_blob) + StructureIDBlob::structureIDOffset();
}
static ptrdiff_t prototypeOffset()
{
return OBJECT_OFFSETOF(Structure, m_prototype);
}
static ptrdiff_t globalObjectOffset()
{
return OBJECT_OFFSETOF(Structure, m_globalObject);
}
static ptrdiff_t classInfoOffset()
{
return OBJECT_OFFSETOF(Structure, m_classInfo);
}
static ptrdiff_t outOfLineTypeFlagsOffset()
{
return OBJECT_OFFSETOF(Structure, m_outOfLineTypeFlags);
}
static ptrdiff_t indexingModeIncludingHistoryOffset()
{
return OBJECT_OFFSETOF(Structure, m_blob) + StructureIDBlob::indexingModeIncludingHistoryOffset();
}
static ptrdiff_t propertyTableUnsafeOffset()
{
return OBJECT_OFFSETOF(Structure, m_propertyTableUnsafe);
}
static ptrdiff_t inlineCapacityOffset()
{
return OBJECT_OFFSETOF(Structure, m_inlineCapacity);
}
static ptrdiff_t previousOrRareDataOffset()
{
return OBJECT_OFFSETOF(Structure, m_previousOrRareData);
}
static Structure* createStructure(VM&);
bool transitionWatchpointSetHasBeenInvalidated() const
{
return m_transitionWatchpointSet.hasBeenInvalidated();
}
bool transitionWatchpointSetIsStillValid() const
{
return m_transitionWatchpointSet.isStillValid();
}
bool dfgShouldWatchIfPossible() const
{
// FIXME: We would like to not watch things that are unprofitable to watch, like
// dictionaries. Unfortunately, we can't do such things: a dictionary could get flattened,
// in which case it will start to appear watchable and so the DFG will think that it is
// watching it. We should come up with a comprehensive story for not watching things that
// aren't profitable to watch.
// https://bugs.webkit.org/show_bug.cgi?id=133625
// - We don't watch Structures that either decided not to be watched, or whose predecessors
// decided not to be watched. This happens when a transition is fired while being watched.
if (transitionWatchpointIsLikelyToBeFired())
return false;
// - Don't watch Structures that had been dictionaries.
if (hasBeenDictionary())
return false;
return true;
}
bool dfgShouldWatch() const
{
return dfgShouldWatchIfPossible() && transitionWatchpointSetIsStillValid();
}
bool propertyNameEnumeratorShouldWatch() const
{
return dfgShouldWatch() && !hasPolyProto();
}
void addTransitionWatchpoint(Watchpoint* watchpoint) const
{
ASSERT(transitionWatchpointSetIsStillValid());
m_transitionWatchpointSet.add(watchpoint);
}
void didTransitionFromThisStructure(DeferredStructureTransitionWatchpointFire* = nullptr) const;
InlineWatchpointSet& transitionWatchpointSet() const
{
return m_transitionWatchpointSet;
}
WatchpointSet* ensurePropertyReplacementWatchpointSet(VM&, PropertyOffset);
void startWatchingPropertyForReplacements(VM& vm, PropertyOffset offset)
{
ensurePropertyReplacementWatchpointSet(vm, offset);
}
void startWatchingPropertyForReplacements(VM&, PropertyName);
WatchpointSet* propertyReplacementWatchpointSet(PropertyOffset);
void didReplaceProperty(PropertyOffset);
void didCachePropertyReplacement(VM&, PropertyOffset);
void startWatchingInternalPropertiesIfNecessary(VM& vm)
{
if (LIKELY(didWatchInternalProperties()))
return;
startWatchingInternalProperties(vm);
}
Ref<StructureShape> toStructureShape(JSValue, bool& sawPolyProtoStructure);
void dump(PrintStream&) const;
void dumpInContext(PrintStream&, DumpContext*) const;
void dumpBrief(PrintStream&, const CString&) const;
static void dumpContextHeader(PrintStream&);
ConcurrentJSLock& lock() { return m_lock; }
unsigned propertyHash() const { return m_propertyHash; }
static bool shouldConvertToPolyProto(const Structure* a, const Structure* b);
UniquedStringImpl* transitionPropertyName() const { return m_transitionPropertyName.get(); }
struct PropertyHashEntry {
const HashTable* table;
const HashTableValue* value;
};
std::optional<PropertyHashEntry> findPropertyHashEntry(PropertyName) const;
DECLARE_EXPORT_INFO;
private:
typedef enum {
NoneDictionaryKind = 0,
CachedDictionaryKind = 1,
UncachedDictionaryKind = 2
} DictionaryKind;
public:
#define DEFINE_BITFIELD(type, lowerName, upperName, width, offset) \
static constexpr uint32_t s_##lowerName##Shift = offset;\
static constexpr uint32_t s_##lowerName##Mask = ((1 << (width - 1)) | ((1 << (width - 1)) - 1));\
static constexpr uint32_t s_bitWidthOf##upperName = width;\
type lowerName() const { return static_cast<type>((m_bitField >> offset) & s_##lowerName##Mask); }\
void set##upperName(type newValue) \
{\
m_bitField &= ~(s_##lowerName##Mask << offset);\
m_bitField |= (static_cast<uint32_t>(newValue) & s_##lowerName##Mask) << offset;\
}
DEFINE_BITFIELD(DictionaryKind, dictionaryKind, DictionaryKind, 2, 0);
DEFINE_BITFIELD(bool, isPinnedPropertyTable, IsPinnedPropertyTable, 1, 2);
DEFINE_BITFIELD(bool, hasGetterSetterProperties, HasGetterSetterProperties, 1, 3);
DEFINE_BITFIELD(bool, hasReadOnlyOrGetterSetterPropertiesExcludingProto, HasReadOnlyOrGetterSetterPropertiesExcludingProto, 1, 4);
DEFINE_BITFIELD(bool, isQuickPropertyAccessAllowedForEnumeration, IsQuickPropertyAccessAllowedForEnumeration, 1, 5);
DEFINE_BITFIELD(TransitionPropertyAttributes, transitionPropertyAttributes, TransitionPropertyAttributes, 8, 6);
DEFINE_BITFIELD(TransitionKind, transitionKind, TransitionKind, 6, 14);
DEFINE_BITFIELD(bool, didPreventExtensions, DidPreventExtensions, 1, 20);
DEFINE_BITFIELD(bool, didTransition, DidTransition, 1, 21);
DEFINE_BITFIELD(bool, staticPropertiesReified, StaticPropertiesReified, 1, 22);
DEFINE_BITFIELD(bool, hasBeenFlattenedBefore, HasBeenFlattenedBefore, 1, 23);
DEFINE_BITFIELD(bool, hasCustomGetterSetterProperties, HasCustomGetterSetterProperties, 1, 24);
DEFINE_BITFIELD(bool, didWatchInternalProperties, DidWatchInternalProperties, 1, 25);
DEFINE_BITFIELD(bool, transitionWatchpointIsLikelyToBeFired, TransitionWatchpointIsLikelyToBeFired, 1, 26);
DEFINE_BITFIELD(bool, hasBeenDictionary, HasBeenDictionary, 1, 27);
DEFINE_BITFIELD(bool, protectPropertyTableWhileTransitioning, ProtectPropertyTableWhileTransitioning, 1, 28);
DEFINE_BITFIELD(bool, hasUnderscoreProtoPropertyExcludingOriginalProto, HasUnderscoreProtoPropertyExcludingOriginalProto, 1, 29);
DEFINE_BITFIELD(bool, isBrandedStructure, IsBrandedStructure, 1, 30);
static_assert(s_bitWidthOfTransitionPropertyAttributes <= sizeof(TransitionPropertyAttributes) * 8);
static_assert(s_bitWidthOfTransitionKind <= sizeof(TransitionKind) * 8);
protected:
Structure(VM&, Structure*, DeferredStructureTransitionWatchpointFire*);
private:
friend class LLIntOffsetsExtractor;
JS_EXPORT_PRIVATE Structure(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType, unsigned inlineCapacity);
Structure(VM&, CreatingEarlyCellTag);
static Structure* create(VM&, Structure*, DeferredStructureTransitionWatchpointFire* = nullptr);
static Structure* addPropertyTransitionToExistingStructureImpl(Structure*, UniquedStringImpl* uid, unsigned attributes, PropertyOffset&);
static Structure* removePropertyTransitionFromExistingStructureImpl(Structure*, PropertyName, unsigned attributes, PropertyOffset&);
static Structure* setBrandTransitionFromExistingStructureImpl(Structure*, UniquedStringImpl*);
// This will return the structure that has a usable property table, that property table,
// and the list of structures that we visited before we got to it. If it returns a
// non-null structure, it will also lock the structure that it returns; it is your job
// to unlock it.
bool findStructuresAndMapForMaterialization(Vector<Structure*, 8>& structures, Structure*& structure, PropertyTable*&) WTF_ACQUIRES_LOCK_IF(true, structure->m_lock);
static Structure* toDictionaryTransition(VM&, Structure*, DictionaryKind, DeferredStructureTransitionWatchpointFire* = nullptr);
enum class ShouldPin { No, Yes };
template<ShouldPin, typename Func>
PropertyOffset add(VM&, PropertyName, unsigned attributes, const Func&);
PropertyOffset add(VM&, PropertyName, unsigned attributes);
template<ShouldPin, typename Func>
PropertyOffset remove(VM&, PropertyName, const Func&);
PropertyOffset remove(VM&, PropertyName);
template<ShouldPin, typename Func>
PropertyOffset attributeChange(VM&, PropertyName, unsigned attributes, const Func&);
PropertyOffset attributeChange(VM&, PropertyName, unsigned attributes);
void checkConsistency();
// This may grab the lock, or not. Do not call when holding the Structure's lock.
PropertyTable* ensurePropertyTableIfNotEmpty(VM& vm)
{
if (PropertyTable* result = m_propertyTableUnsafe.get())
return result;
if (!previousID())
return nullptr;
return materializePropertyTable(vm);
}
// This may grab the lock, or not. Do not call when holding the Structure's lock.
PropertyTable* ensurePropertyTable(VM& vm)
{
if (PropertyTable* result = m_propertyTableUnsafe.get())
return result;
return materializePropertyTable(vm);
}
PropertyTable* propertyTableOrNull() const
{
return m_propertyTableUnsafe.get();
}
// This will grab the lock. Do not call when holding the Structure's lock.
JS_EXPORT_PRIVATE PropertyTable* materializePropertyTable(VM&, bool setPropertyTable = true);
void setPropertyTable(VM& vm, PropertyTable* table);
PropertyTable* takePropertyTableOrCloneIfPinned(VM&);
PropertyTable* copyPropertyTableForPinning(VM&);
void setPreviousID(VM&, Structure*);
void clearPreviousID()
{
if (hasRareData())
rareData()->clearPreviousID();
else
m_previousOrRareData.clear();
}
int transitionCountEstimate() const
{
// Since the number of transitions is often the same as the last offset (except if there are deletes)
// we keep the size of Structure down by not storing both.
return numberOfSlotsForMaxOffset(maxOffset(), m_inlineCapacity);
}
ALWAYS_INLINE bool transitionCountHasOverflowed() const
{
int transitionCount = 0;
for (auto* structure = this; structure; structure = structure->previousID()) {
if (++transitionCount > s_maxTransitionLength)
return true;
}
return false;
}
bool isValid(JSGlobalObject*, StructureChain* cachedPrototypeChain, JSObject* base) const;
// You have to hold the structure lock to do these.
JS_EXPORT_PRIVATE void pin(const AbstractLocker&, VM&, PropertyTable*);
void pinForCaching(const AbstractLocker&, VM&, PropertyTable*);
static bool isRareData(JSCell* cell)
{
return cell && cell->type() != StructureType;
}
template<typename DetailsFunc>
bool checkOffsetConsistency(PropertyTable*, const DetailsFunc&) const;
bool checkOffsetConsistency() const;
JS_EXPORT_PRIVATE void allocateRareData(VM&);
void startWatchingInternalProperties(VM&);
void clearCachedPrototypeChain();
static constexpr int s_maxTransitionLength = 64;
static constexpr int s_maxTransitionLengthForNonEvalPutById = 512;
// These need to be properly aligned at the beginning of the 'Structure'
// part of the object.
StructureIDBlob m_blob;
TypeInfo::OutOfLineTypeFlags m_outOfLineTypeFlags;
uint8_t m_inlineCapacity;
ConcurrentJSLock m_lock;
uint32_t m_bitField;
WriteBarrier<JSGlobalObject> m_globalObject;
WriteBarrier<Unknown> m_prototype;
mutable WriteBarrier<StructureChain> m_cachedPrototypeChain;
WriteBarrier<JSCell> m_previousOrRareData;
RefPtr<UniquedStringImpl> m_transitionPropertyName;
const ClassInfo* m_classInfo;
StructureTransitionTable m_transitionTable;
// Should be accessed through ensurePropertyTable(). During GC, it may be set to 0 by another thread.
// During a Heap Snapshot GC we avoid clearing the table so it is safe to use.
WriteBarrier<PropertyTable> m_propertyTableUnsafe;
mutable InlineWatchpointSet m_transitionWatchpointSet;
COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);
uint16_t m_transitionOffset;
uint16_t m_maxOffset;
uint32_t m_propertyHash;
TinyBloomFilter m_seenProperties;
friend class VMInspector;
friend class JSDollarVMHelper;
};
} // namespace JSC