1// Copyright 2012 the V8 project authors. All rights reserved.
2// Redistribution and use in source and binary forms, with or without
3// modification, are permitted provided that the following conditions are
4// met:
5//
6//     * Redistributions of source code must retain the above copyright
7//       notice, this list of conditions and the following disclaimer.
8//     * Redistributions in binary form must reproduce the above
9//       copyright notice, this list of conditions and the following
10//       disclaimer in the documentation and/or other materials provided
11//       with the distribution.
12//     * Neither the name of Google Inc. nor the names of its
13//       contributors may be used to endorse or promote products derived
14//       from this software without specific prior written permission.
15//
16// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
19// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
20// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
21// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
22// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
26// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27
28#ifndef V8_OBJECTS_H_
29#define V8_OBJECTS_H_
30
31#include "allocation.h"
32#include "builtins.h"
33#include "list.h"
34#include "property-details.h"
35#include "smart-array-pointer.h"
36#include "unicode-inl.h"
37#if V8_TARGET_ARCH_ARM
38#include "arm/constants-arm.h"
39#elif V8_TARGET_ARCH_MIPS
40#include "mips/constants-mips.h"
41#endif
42#include "v8checks.h"
43
44
45//
46// Most object types in the V8 JavaScript are described in this file.
47//
48// Inheritance hierarchy:
49// - MaybeObject    (an object or a failure)
50//   - Failure      (immediate for marking failed operation)
51//   - Object
52//     - Smi          (immediate small integer)
53//     - HeapObject   (superclass for everything allocated in the heap)
54//       - JSReceiver  (suitable for property access)
55//         - JSObject
56//           - JSArray
57//           - JSSet
58//           - JSMap
59//           - JSWeakMap
60//           - JSRegExp
61//           - JSFunction
62//           - GlobalObject
63//             - JSGlobalObject
64//             - JSBuiltinsObject
65//           - JSGlobalProxy
66//           - JSValue
67//             - JSDate
68//           - JSMessageObject
69//         - JSProxy
70//           - JSFunctionProxy
71//       - FixedArrayBase
72//         - ByteArray
73//         - FixedArray
74//           - DescriptorArray
75//           - HashTable
76//             - Dictionary
77//             - SymbolTable
78//             - CompilationCacheTable
79//             - CodeCacheHashTable
80//             - MapCache
81//           - Context
82//           - JSFunctionResultCache
83//           - ScopeInfo
84//         - FixedDoubleArray
85//         - ExternalArray
86//           - ExternalPixelArray
87//           - ExternalByteArray
88//           - ExternalUnsignedByteArray
89//           - ExternalShortArray
90//           - ExternalUnsignedShortArray
91//           - ExternalIntArray
92//           - ExternalUnsignedIntArray
93//           - ExternalFloatArray
94//       - String
95//         - SeqString
96//           - SeqAsciiString
97//           - SeqTwoByteString
98//         - SlicedString
99//         - ConsString
100//         - ExternalString
101//           - ExternalAsciiString
102//           - ExternalTwoByteString
103//       - HeapNumber
104//       - Code
105//       - Map
106//       - Oddball
107//       - Foreign
108//       - SharedFunctionInfo
109//       - Struct
110//         - AccessorInfo
111//         - AccessorPair
112//         - AccessCheckInfo
113//         - InterceptorInfo
114//         - CallHandlerInfo
115//         - TemplateInfo
116//           - FunctionTemplateInfo
117//           - ObjectTemplateInfo
118//         - Script
119//         - SignatureInfo
120//         - TypeSwitchInfo
121//         - DebugInfo
122//         - BreakPointInfo
123//         - CodeCache
124//
125// Formats of Object*:
126//  Smi:        [31 bit signed int] 0
127//  HeapObject: [32 bit direct pointer] (4 byte aligned) | 01
128//  Failure:    [30 bit signed int] 11
129
130namespace v8 {
131namespace internal {
132
133enum ElementsKind {
134  // The "fast" kind for elements that only contain SMI values. Must be first
135  // to make it possible to efficiently check maps for this kind.
136  FAST_SMI_ONLY_ELEMENTS,
137
138  // The "fast" kind for tagged values. Must be second to make it possible to
139  // efficiently check maps for this and the FAST_SMI_ONLY_ELEMENTS kind
140  // together at once.
141  FAST_ELEMENTS,
142
143  // The "fast" kind for unwrapped, non-tagged double values.
144  FAST_DOUBLE_ELEMENTS,
145
146  // The "slow" kind.
147  DICTIONARY_ELEMENTS,
148  NON_STRICT_ARGUMENTS_ELEMENTS,
149  // The "fast" kind for external arrays
150  EXTERNAL_BYTE_ELEMENTS,
151  EXTERNAL_UNSIGNED_BYTE_ELEMENTS,
152  EXTERNAL_SHORT_ELEMENTS,
153  EXTERNAL_UNSIGNED_SHORT_ELEMENTS,
154  EXTERNAL_INT_ELEMENTS,
155  EXTERNAL_UNSIGNED_INT_ELEMENTS,
156  EXTERNAL_FLOAT_ELEMENTS,
157  EXTERNAL_DOUBLE_ELEMENTS,
158  EXTERNAL_PIXEL_ELEMENTS,
159
160  // Derived constants from ElementsKind
161  FIRST_EXTERNAL_ARRAY_ELEMENTS_KIND = EXTERNAL_BYTE_ELEMENTS,
162  LAST_EXTERNAL_ARRAY_ELEMENTS_KIND = EXTERNAL_PIXEL_ELEMENTS,
163  FIRST_ELEMENTS_KIND = FAST_SMI_ONLY_ELEMENTS,
164  LAST_ELEMENTS_KIND = EXTERNAL_PIXEL_ELEMENTS
165};
166
167enum CompareMapMode {
168  REQUIRE_EXACT_MAP,
169  ALLOW_ELEMENT_TRANSITION_MAPS
170};
171
172enum KeyedAccessGrowMode {
173  DO_NOT_ALLOW_JSARRAY_GROWTH,
174  ALLOW_JSARRAY_GROWTH
175};
176
177const int kElementsKindCount = LAST_ELEMENTS_KIND - FIRST_ELEMENTS_KIND + 1;
178
179void PrintElementsKind(FILE* out, ElementsKind kind);
180
181inline bool IsMoreGeneralElementsKindTransition(ElementsKind from_kind,
182                                                ElementsKind to_kind);
183
184// Setter that skips the write barrier if mode is SKIP_WRITE_BARRIER.
185enum WriteBarrierMode { SKIP_WRITE_BARRIER, UPDATE_WRITE_BARRIER };
186
187
188// PropertyNormalizationMode is used to specify whether to keep
189// inobject properties when normalizing properties of a JSObject.
190enum PropertyNormalizationMode {
191  CLEAR_INOBJECT_PROPERTIES,
192  KEEP_INOBJECT_PROPERTIES
193};
194
195
196// NormalizedMapSharingMode is used to specify whether a map may be shared
197// by different objects with normalized properties.
198enum NormalizedMapSharingMode {
199  UNIQUE_NORMALIZED_MAP,
200  SHARED_NORMALIZED_MAP
201};
202
203
204// Indicates whether a get method should implicitly create the object looked up.
205enum CreationFlag {
206  ALLOW_CREATION,
207  OMIT_CREATION
208};
209
210
211// Instance size sentinel for objects of variable size.
212const int kVariableSizeSentinel = 0;
213
214
215// All Maps have a field instance_type containing a InstanceType.
216// It describes the type of the instances.
217//
218// As an example, a JavaScript object is a heap object and its map
219// instance_type is JS_OBJECT_TYPE.
220//
221// The names of the string instance types are intended to systematically
222// mirror their encoding in the instance_type field of the map.  The default
223// encoding is considered TWO_BYTE.  It is not mentioned in the name.  ASCII
224// encoding is mentioned explicitly in the name.  Likewise, the default
225// representation is considered sequential.  It is not mentioned in the
226// name.  The other representations (e.g. CONS, EXTERNAL) are explicitly
227// mentioned.  Finally, the string is either a SYMBOL_TYPE (if it is a
228// symbol) or a STRING_TYPE (if it is not a symbol).
229//
230// NOTE: The following things are some that depend on the string types having
231// instance_types that are less than those of all other types:
232// HeapObject::Size, HeapObject::IterateBody, the typeof operator, and
233// Object::IsString.
234//
235// NOTE: Everything following JS_VALUE_TYPE is considered a
236// JSObject for GC purposes. The first four entries here have typeof
237// 'object', whereas JS_FUNCTION_TYPE has typeof 'function'.
238#define INSTANCE_TYPE_LIST_ALL(V)                                              \
239  V(SYMBOL_TYPE)                                                               \
240  V(ASCII_SYMBOL_TYPE)                                                         \
241  V(CONS_SYMBOL_TYPE)                                                          \
242  V(CONS_ASCII_SYMBOL_TYPE)                                                    \
243  V(EXTERNAL_SYMBOL_TYPE)                                                      \
244  V(EXTERNAL_SYMBOL_WITH_ASCII_DATA_TYPE)                                      \
245  V(EXTERNAL_ASCII_SYMBOL_TYPE)                                                \
246  V(SHORT_EXTERNAL_SYMBOL_TYPE)                                                \
247  V(SHORT_EXTERNAL_SYMBOL_WITH_ASCII_DATA_TYPE)                                \
248  V(SHORT_EXTERNAL_ASCII_SYMBOL_TYPE)                                          \
249  V(STRING_TYPE)                                                               \
250  V(ASCII_STRING_TYPE)                                                         \
251  V(CONS_STRING_TYPE)                                                          \
252  V(CONS_ASCII_STRING_TYPE)                                                    \
253  V(SLICED_STRING_TYPE)                                                        \
254  V(EXTERNAL_STRING_TYPE)                                                      \
255  V(EXTERNAL_STRING_WITH_ASCII_DATA_TYPE)                                      \
256  V(EXTERNAL_ASCII_STRING_TYPE)                                                \
257  V(SHORT_EXTERNAL_STRING_TYPE)                                                \
258  V(SHORT_EXTERNAL_STRING_WITH_ASCII_DATA_TYPE)                                \
259  V(SHORT_EXTERNAL_ASCII_STRING_TYPE)                                          \
260  V(PRIVATE_EXTERNAL_ASCII_STRING_TYPE)                                        \
261                                                                               \
262  V(MAP_TYPE)                                                                  \
263  V(CODE_TYPE)                                                                 \
264  V(ODDBALL_TYPE)                                                              \
265  V(JS_GLOBAL_PROPERTY_CELL_TYPE)                                              \
266                                                                               \
267  V(HEAP_NUMBER_TYPE)                                                          \
268  V(FOREIGN_TYPE)                                                              \
269  V(BYTE_ARRAY_TYPE)                                                           \
270  V(FREE_SPACE_TYPE)                                                           \
271  /* Note: the order of these external array */                                \
272  /* types is relied upon in */                                                \
273  /* Object::IsExternalArray(). */                                             \
274  V(EXTERNAL_BYTE_ARRAY_TYPE)                                                  \
275  V(EXTERNAL_UNSIGNED_BYTE_ARRAY_TYPE)                                         \
276  V(EXTERNAL_SHORT_ARRAY_TYPE)                                                 \
277  V(EXTERNAL_UNSIGNED_SHORT_ARRAY_TYPE)                                        \
278  V(EXTERNAL_INT_ARRAY_TYPE)                                                   \
279  V(EXTERNAL_UNSIGNED_INT_ARRAY_TYPE)                                          \
280  V(EXTERNAL_FLOAT_ARRAY_TYPE)                                                 \
281  V(EXTERNAL_PIXEL_ARRAY_TYPE)                                                 \
282  V(FILLER_TYPE)                                                               \
283                                                                               \
284  V(ACCESSOR_INFO_TYPE)                                                        \
285  V(ACCESSOR_PAIR_TYPE)                                                        \
286  V(ACCESS_CHECK_INFO_TYPE)                                                    \
287  V(INTERCEPTOR_INFO_TYPE)                                                     \
288  V(CALL_HANDLER_INFO_TYPE)                                                    \
289  V(FUNCTION_TEMPLATE_INFO_TYPE)                                               \
290  V(OBJECT_TEMPLATE_INFO_TYPE)                                                 \
291  V(SIGNATURE_INFO_TYPE)                                                       \
292  V(TYPE_SWITCH_INFO_TYPE)                                                     \
293  V(SCRIPT_TYPE)                                                               \
294  V(CODE_CACHE_TYPE)                                                           \
295  V(POLYMORPHIC_CODE_CACHE_TYPE)                                               \
296  V(TYPE_FEEDBACK_INFO_TYPE)                                                   \
297  V(ALIASED_ARGUMENTS_ENTRY_TYPE)                                              \
298                                                                               \
299  V(FIXED_ARRAY_TYPE)                                                          \
300  V(FIXED_DOUBLE_ARRAY_TYPE)                                                   \
301  V(SHARED_FUNCTION_INFO_TYPE)                                                 \
302                                                                               \
303  V(JS_MESSAGE_OBJECT_TYPE)                                                    \
304                                                                               \
305  V(JS_VALUE_TYPE)                                                             \
306  V(JS_DATE_TYPE)                                                              \
307  V(JS_OBJECT_TYPE)                                                            \
308  V(JS_CONTEXT_EXTENSION_OBJECT_TYPE)                                          \
309  V(JS_GLOBAL_OBJECT_TYPE)                                                     \
310  V(JS_BUILTINS_OBJECT_TYPE)                                                   \
311  V(JS_GLOBAL_PROXY_TYPE)                                                      \
312  V(JS_ARRAY_TYPE)                                                             \
313  V(JS_PROXY_TYPE)                                                             \
314  V(JS_WEAK_MAP_TYPE)                                                          \
315  V(JS_REGEXP_TYPE)                                                            \
316                                                                               \
317  V(JS_FUNCTION_TYPE)                                                          \
318  V(JS_FUNCTION_PROXY_TYPE)                                                    \
319
320#ifdef ENABLE_DEBUGGER_SUPPORT
321#define INSTANCE_TYPE_LIST_DEBUGGER(V)                                         \
322  V(DEBUG_INFO_TYPE)                                                           \
323  V(BREAK_POINT_INFO_TYPE)
324#else
325#define INSTANCE_TYPE_LIST_DEBUGGER(V)
326#endif
327
328#define INSTANCE_TYPE_LIST(V)                                                  \
329  INSTANCE_TYPE_LIST_ALL(V)                                                    \
330  INSTANCE_TYPE_LIST_DEBUGGER(V)
331
332
333// Since string types are not consecutive, this macro is used to
334// iterate over them.
335#define STRING_TYPE_LIST(V)                                                    \
336  V(SYMBOL_TYPE,                                                               \
337    kVariableSizeSentinel,                                                     \
338    symbol,                                                                    \
339    Symbol)                                                                    \
340  V(ASCII_SYMBOL_TYPE,                                                         \
341    kVariableSizeSentinel,                                                     \
342    ascii_symbol,                                                              \
343    AsciiSymbol)                                                               \
344  V(CONS_SYMBOL_TYPE,                                                          \
345    ConsString::kSize,                                                         \
346    cons_symbol,                                                               \
347    ConsSymbol)                                                                \
348  V(CONS_ASCII_SYMBOL_TYPE,                                                    \
349    ConsString::kSize,                                                         \
350    cons_ascii_symbol,                                                         \
351    ConsAsciiSymbol)                                                           \
352  V(EXTERNAL_SYMBOL_TYPE,                                                      \
353    ExternalTwoByteString::kSize,                                              \
354    external_symbol,                                                           \
355    ExternalSymbol)                                                            \
356  V(EXTERNAL_SYMBOL_WITH_ASCII_DATA_TYPE,                                      \
357    ExternalTwoByteString::kSize,                                              \
358    external_symbol_with_ascii_data,                                           \
359    ExternalSymbolWithAsciiData)                                               \
360  V(EXTERNAL_ASCII_SYMBOL_TYPE,                                                \
361    ExternalAsciiString::kSize,                                                \
362    external_ascii_symbol,                                                     \
363    ExternalAsciiSymbol)                                                       \
364  V(SHORT_EXTERNAL_SYMBOL_TYPE,                                                \
365    ExternalTwoByteString::kShortSize,                                         \
366    short_external_symbol,                                                     \
367    ShortExternalSymbol)                                                       \
368  V(SHORT_EXTERNAL_SYMBOL_WITH_ASCII_DATA_TYPE,                                \
369    ExternalTwoByteString::kShortSize,                                         \
370    short_external_symbol_with_ascii_data,                                     \
371    ShortExternalSymbolWithAsciiData)                                          \
372  V(SHORT_EXTERNAL_ASCII_SYMBOL_TYPE,                                          \
373    ExternalAsciiString::kShortSize,                                           \
374    short_external_ascii_symbol,                                               \
375    ShortExternalAsciiSymbol)                                                  \
376  V(STRING_TYPE,                                                               \
377    kVariableSizeSentinel,                                                     \
378    string,                                                                    \
379    String)                                                                    \
380  V(ASCII_STRING_TYPE,                                                         \
381    kVariableSizeSentinel,                                                     \
382    ascii_string,                                                              \
383    AsciiString)                                                               \
384  V(CONS_STRING_TYPE,                                                          \
385    ConsString::kSize,                                                         \
386    cons_string,                                                               \
387    ConsString)                                                                \
388  V(CONS_ASCII_STRING_TYPE,                                                    \
389    ConsString::kSize,                                                         \
390    cons_ascii_string,                                                         \
391    ConsAsciiString)                                                           \
392  V(SLICED_STRING_TYPE,                                                        \
393    SlicedString::kSize,                                                       \
394    sliced_string,                                                             \
395    SlicedString)                                                              \
396  V(SLICED_ASCII_STRING_TYPE,                                                  \
397    SlicedString::kSize,                                                       \
398    sliced_ascii_string,                                                       \
399    SlicedAsciiString)                                                         \
400  V(EXTERNAL_STRING_TYPE,                                                      \
401    ExternalTwoByteString::kSize,                                              \
402    external_string,                                                           \
403    ExternalString)                                                            \
404  V(EXTERNAL_STRING_WITH_ASCII_DATA_TYPE,                                      \
405    ExternalTwoByteString::kSize,                                              \
406    external_string_with_ascii_data,                                           \
407    ExternalStringWithAsciiData)                                               \
408  V(EXTERNAL_ASCII_STRING_TYPE,                                                \
409    ExternalAsciiString::kSize,                                                \
410    external_ascii_string,                                                     \
411    ExternalAsciiString)                                                       \
412  V(SHORT_EXTERNAL_STRING_TYPE,                                                \
413    ExternalTwoByteString::kShortSize,                                         \
414    short_external_string,                                                     \
415    ShortExternalString)                                                       \
416  V(SHORT_EXTERNAL_STRING_WITH_ASCII_DATA_TYPE,                                \
417    ExternalTwoByteString::kShortSize,                                         \
418    short_external_string_with_ascii_data,                                     \
419    ShortExternalStringWithAsciiData)                                          \
420  V(SHORT_EXTERNAL_ASCII_STRING_TYPE,                                          \
421    ExternalAsciiString::kShortSize,                                           \
422    short_external_ascii_string,                                               \
423    ShortExternalAsciiString)
424
425// A struct is a simple object a set of object-valued fields.  Including an
426// object type in this causes the compiler to generate most of the boilerplate
427// code for the class including allocation and garbage collection routines,
428// casts and predicates.  All you need to define is the class, methods and
429// object verification routines.  Easy, no?
430//
431// Note that for subtle reasons related to the ordering or numerical values of
432// type tags, elements in this list have to be added to the INSTANCE_TYPE_LIST
433// manually.
434#define STRUCT_LIST_ALL(V)                                                     \
435  V(ACCESSOR_INFO, AccessorInfo, accessor_info)                                \
436  V(ACCESSOR_PAIR, AccessorPair, accessor_pair)                                \
437  V(ACCESS_CHECK_INFO, AccessCheckInfo, access_check_info)                     \
438  V(INTERCEPTOR_INFO, InterceptorInfo, interceptor_info)                       \
439  V(CALL_HANDLER_INFO, CallHandlerInfo, call_handler_info)                     \
440  V(FUNCTION_TEMPLATE_INFO, FunctionTemplateInfo, function_template_info)      \
441  V(OBJECT_TEMPLATE_INFO, ObjectTemplateInfo, object_template_info)            \
442  V(SIGNATURE_INFO, SignatureInfo, signature_info)                             \
443  V(TYPE_SWITCH_INFO, TypeSwitchInfo, type_switch_info)                        \
444  V(SCRIPT, Script, script)                                                    \
445  V(CODE_CACHE, CodeCache, code_cache)                                         \
446  V(POLYMORPHIC_CODE_CACHE, PolymorphicCodeCache, polymorphic_code_cache)      \
447  V(TYPE_FEEDBACK_INFO, TypeFeedbackInfo, type_feedback_info)                  \
448  V(ALIASED_ARGUMENTS_ENTRY, AliasedArgumentsEntry, aliased_arguments_entry)
449
450#ifdef ENABLE_DEBUGGER_SUPPORT
451#define STRUCT_LIST_DEBUGGER(V)                                                \
452  V(DEBUG_INFO, DebugInfo, debug_info)                                         \
453  V(BREAK_POINT_INFO, BreakPointInfo, break_point_info)
454#else
455#define STRUCT_LIST_DEBUGGER(V)
456#endif
457
458#define STRUCT_LIST(V)                                                         \
459  STRUCT_LIST_ALL(V)                                                           \
460  STRUCT_LIST_DEBUGGER(V)
461
462// We use the full 8 bits of the instance_type field to encode heap object
463// instance types.  The high-order bit (bit 7) is set if the object is not a
464// string, and cleared if it is a string.
465const uint32_t kIsNotStringMask = 0x80;
466const uint32_t kStringTag = 0x0;
467const uint32_t kNotStringTag = 0x80;
468
469// Bit 6 indicates that the object is a symbol (if set) or not (if cleared).
470// There are not enough types that the non-string types (with bit 7 set) can
471// have bit 6 set too.
472const uint32_t kIsSymbolMask = 0x40;
473const uint32_t kNotSymbolTag = 0x0;
474const uint32_t kSymbolTag = 0x40;
475
476// If bit 7 is clear then bit 2 indicates whether the string consists of
477// two-byte characters or one-byte characters.
478const uint32_t kStringEncodingMask = 0x4;
479const uint32_t kTwoByteStringTag = 0x0;
480const uint32_t kAsciiStringTag = 0x4;
481
482// If bit 7 is clear, the low-order 2 bits indicate the representation
483// of the string.
484const uint32_t kStringRepresentationMask = 0x03;
485enum StringRepresentationTag {
486  kSeqStringTag = 0x0,
487  kConsStringTag = 0x1,
488  kExternalStringTag = 0x2,
489  kSlicedStringTag = 0x3
490};
491const uint32_t kIsIndirectStringMask = 0x1;
492const uint32_t kIsIndirectStringTag = 0x1;
493STATIC_ASSERT((kSeqStringTag & kIsIndirectStringMask) == 0);
494STATIC_ASSERT((kExternalStringTag & kIsIndirectStringMask) == 0);
495STATIC_ASSERT(
496    (kConsStringTag & kIsIndirectStringMask) == kIsIndirectStringTag);
497STATIC_ASSERT(
498    (kSlicedStringTag & kIsIndirectStringMask) == kIsIndirectStringTag);
499
500// Use this mask to distinguish between cons and slice only after making
501// sure that the string is one of the two (an indirect string).
502const uint32_t kSlicedNotConsMask = kSlicedStringTag & ~kConsStringTag;
503STATIC_ASSERT(IS_POWER_OF_TWO(kSlicedNotConsMask) && kSlicedNotConsMask != 0);
504
505// If bit 7 is clear, then bit 3 indicates whether this two-byte
506// string actually contains ASCII data.
507const uint32_t kAsciiDataHintMask = 0x08;
508const uint32_t kAsciiDataHintTag = 0x08;
509
510// If bit 7 is clear and string representation indicates an external string,
511// then bit 4 indicates whether the data pointer is cached.
512const uint32_t kShortExternalStringMask = 0x10;
513const uint32_t kShortExternalStringTag = 0x10;
514
515
516// A ConsString with an empty string as the right side is a candidate
517// for being shortcut by the garbage collector unless it is a
518// symbol. It's not common to have non-flat symbols, so we do not
519// shortcut them thereby avoiding turning symbols into strings. See
520// heap.cc and mark-compact.cc.
521const uint32_t kShortcutTypeMask =
522    kIsNotStringMask |
523    kIsSymbolMask |
524    kStringRepresentationMask;
525const uint32_t kShortcutTypeTag = kConsStringTag;
526
527
528enum InstanceType {
529  // String types.
530  SYMBOL_TYPE = kTwoByteStringTag | kSymbolTag | kSeqStringTag,
531  ASCII_SYMBOL_TYPE = kAsciiStringTag | kSymbolTag | kSeqStringTag,
532  CONS_SYMBOL_TYPE = kTwoByteStringTag | kSymbolTag | kConsStringTag,
533  CONS_ASCII_SYMBOL_TYPE = kAsciiStringTag | kSymbolTag | kConsStringTag,
534  SHORT_EXTERNAL_SYMBOL_TYPE = kTwoByteStringTag | kSymbolTag |
535                               kExternalStringTag | kShortExternalStringTag,
536  SHORT_EXTERNAL_SYMBOL_WITH_ASCII_DATA_TYPE =
537      kTwoByteStringTag | kSymbolTag | kExternalStringTag |
538      kAsciiDataHintTag | kShortExternalStringTag,
539  SHORT_EXTERNAL_ASCII_SYMBOL_TYPE = kAsciiStringTag | kExternalStringTag |
540                                     kSymbolTag | kShortExternalStringTag,
541  EXTERNAL_SYMBOL_TYPE = kTwoByteStringTag | kSymbolTag | kExternalStringTag,
542  EXTERNAL_SYMBOL_WITH_ASCII_DATA_TYPE =
543      kTwoByteStringTag | kSymbolTag | kExternalStringTag | kAsciiDataHintTag,
544  EXTERNAL_ASCII_SYMBOL_TYPE =
545      kAsciiStringTag | kSymbolTag | kExternalStringTag,
546  STRING_TYPE = kTwoByteStringTag | kSeqStringTag,
547  ASCII_STRING_TYPE = kAsciiStringTag | kSeqStringTag,
548  CONS_STRING_TYPE = kTwoByteStringTag | kConsStringTag,
549  CONS_ASCII_STRING_TYPE = kAsciiStringTag | kConsStringTag,
550  SLICED_STRING_TYPE = kTwoByteStringTag | kSlicedStringTag,
551  SLICED_ASCII_STRING_TYPE = kAsciiStringTag | kSlicedStringTag,
552  SHORT_EXTERNAL_STRING_TYPE =
553      kTwoByteStringTag | kExternalStringTag | kShortExternalStringTag,
554  SHORT_EXTERNAL_STRING_WITH_ASCII_DATA_TYPE =
555      kTwoByteStringTag | kExternalStringTag |
556      kAsciiDataHintTag | kShortExternalStringTag,
557  SHORT_EXTERNAL_ASCII_STRING_TYPE =
558      kAsciiStringTag | kExternalStringTag | kShortExternalStringTag,
559  EXTERNAL_STRING_TYPE = kTwoByteStringTag | kExternalStringTag,
560  EXTERNAL_STRING_WITH_ASCII_DATA_TYPE =
561      kTwoByteStringTag | kExternalStringTag | kAsciiDataHintTag,
562  // LAST_STRING_TYPE
563  EXTERNAL_ASCII_STRING_TYPE = kAsciiStringTag | kExternalStringTag,
564  PRIVATE_EXTERNAL_ASCII_STRING_TYPE = EXTERNAL_ASCII_STRING_TYPE,
565
566  // Objects allocated in their own spaces (never in new space).
567  MAP_TYPE = kNotStringTag,  // FIRST_NONSTRING_TYPE
568  CODE_TYPE,
569  ODDBALL_TYPE,
570  JS_GLOBAL_PROPERTY_CELL_TYPE,
571
572  // "Data", objects that cannot contain non-map-word pointers to heap
573  // objects.
574  HEAP_NUMBER_TYPE,
575  FOREIGN_TYPE,
576  BYTE_ARRAY_TYPE,
577  FREE_SPACE_TYPE,
578  EXTERNAL_BYTE_ARRAY_TYPE,  // FIRST_EXTERNAL_ARRAY_TYPE
579  EXTERNAL_UNSIGNED_BYTE_ARRAY_TYPE,
580  EXTERNAL_SHORT_ARRAY_TYPE,
581  EXTERNAL_UNSIGNED_SHORT_ARRAY_TYPE,
582  EXTERNAL_INT_ARRAY_TYPE,
583  EXTERNAL_UNSIGNED_INT_ARRAY_TYPE,
584  EXTERNAL_FLOAT_ARRAY_TYPE,
585  EXTERNAL_DOUBLE_ARRAY_TYPE,
586  EXTERNAL_PIXEL_ARRAY_TYPE,  // LAST_EXTERNAL_ARRAY_TYPE
587  FIXED_DOUBLE_ARRAY_TYPE,
588  FILLER_TYPE,  // LAST_DATA_TYPE
589
590  // Structs.
591  ACCESSOR_INFO_TYPE,
592  ACCESSOR_PAIR_TYPE,
593  ACCESS_CHECK_INFO_TYPE,
594  INTERCEPTOR_INFO_TYPE,
595  CALL_HANDLER_INFO_TYPE,
596  FUNCTION_TEMPLATE_INFO_TYPE,
597  OBJECT_TEMPLATE_INFO_TYPE,
598  SIGNATURE_INFO_TYPE,
599  TYPE_SWITCH_INFO_TYPE,
600  SCRIPT_TYPE,
601  CODE_CACHE_TYPE,
602  POLYMORPHIC_CODE_CACHE_TYPE,
603  TYPE_FEEDBACK_INFO_TYPE,
604  ALIASED_ARGUMENTS_ENTRY_TYPE,
605  // The following two instance types are only used when ENABLE_DEBUGGER_SUPPORT
606  // is defined. However as include/v8.h contain some of the instance type
607  // constants always having them avoids them getting different numbers
608  // depending on whether ENABLE_DEBUGGER_SUPPORT is defined or not.
609  DEBUG_INFO_TYPE,
610  BREAK_POINT_INFO_TYPE,
611
612  FIXED_ARRAY_TYPE,
613  SHARED_FUNCTION_INFO_TYPE,
614
615  JS_MESSAGE_OBJECT_TYPE,
616
617  // All the following types are subtypes of JSReceiver, which corresponds to
618  // objects in the JS sense. The first and the last type in this range are
619  // the two forms of function. This organization enables using the same
620  // compares for checking the JS_RECEIVER/SPEC_OBJECT range and the
621  // NONCALLABLE_JS_OBJECT range.
622  JS_FUNCTION_PROXY_TYPE,  // FIRST_JS_RECEIVER_TYPE, FIRST_JS_PROXY_TYPE
623  JS_PROXY_TYPE,  // LAST_JS_PROXY_TYPE
624
625  JS_VALUE_TYPE,  // FIRST_JS_OBJECT_TYPE
626  JS_DATE_TYPE,
627  JS_OBJECT_TYPE,
628  JS_CONTEXT_EXTENSION_OBJECT_TYPE,
629  JS_GLOBAL_OBJECT_TYPE,
630  JS_BUILTINS_OBJECT_TYPE,
631  JS_GLOBAL_PROXY_TYPE,
632  JS_ARRAY_TYPE,
633  JS_SET_TYPE,
634  JS_MAP_TYPE,
635  JS_WEAK_MAP_TYPE,
636
637  JS_REGEXP_TYPE,
638
639  JS_FUNCTION_TYPE,  // LAST_JS_OBJECT_TYPE, LAST_JS_RECEIVER_TYPE
640
641  // Pseudo-types
642  FIRST_TYPE = 0x0,
643  LAST_TYPE = JS_FUNCTION_TYPE,
644  INVALID_TYPE = FIRST_TYPE - 1,
645  FIRST_NONSTRING_TYPE = MAP_TYPE,
646  // Boundaries for testing for an external array.
647  FIRST_EXTERNAL_ARRAY_TYPE = EXTERNAL_BYTE_ARRAY_TYPE,
648  LAST_EXTERNAL_ARRAY_TYPE = EXTERNAL_PIXEL_ARRAY_TYPE,
649  // Boundary for promotion to old data space/old pointer space.
650  LAST_DATA_TYPE = FILLER_TYPE,
651  // Boundary for objects represented as JSReceiver (i.e. JSObject or JSProxy).
652  // Note that there is no range for JSObject or JSProxy, since their subtypes
653  // are not continuous in this enum! The enum ranges instead reflect the
654  // external class names, where proxies are treated as either ordinary objects,
655  // or functions.
656  FIRST_JS_RECEIVER_TYPE = JS_FUNCTION_PROXY_TYPE,
657  LAST_JS_RECEIVER_TYPE = LAST_TYPE,
658  // Boundaries for testing the types represented as JSObject
659  FIRST_JS_OBJECT_TYPE = JS_VALUE_TYPE,
660  LAST_JS_OBJECT_TYPE = LAST_TYPE,
661  // Boundaries for testing the types represented as JSProxy
662  FIRST_JS_PROXY_TYPE = JS_FUNCTION_PROXY_TYPE,
663  LAST_JS_PROXY_TYPE = JS_PROXY_TYPE,
664  // Boundaries for testing whether the type is a JavaScript object.
665  FIRST_SPEC_OBJECT_TYPE = FIRST_JS_RECEIVER_TYPE,
666  LAST_SPEC_OBJECT_TYPE = LAST_JS_RECEIVER_TYPE,
667  // Boundaries for testing the types for which typeof is "object".
668  FIRST_NONCALLABLE_SPEC_OBJECT_TYPE = JS_PROXY_TYPE,
669  LAST_NONCALLABLE_SPEC_OBJECT_TYPE = JS_REGEXP_TYPE,
670  // Note that the types for which typeof is "function" are not continuous.
671  // Define this so that we can put assertions on discrete checks.
672  NUM_OF_CALLABLE_SPEC_OBJECT_TYPES = 2
673};
674
675const int kExternalArrayTypeCount =
676    LAST_EXTERNAL_ARRAY_TYPE - FIRST_EXTERNAL_ARRAY_TYPE + 1;
677
678STATIC_CHECK(JS_OBJECT_TYPE == Internals::kJSObjectType);
679STATIC_CHECK(FIRST_NONSTRING_TYPE == Internals::kFirstNonstringType);
680STATIC_CHECK(FOREIGN_TYPE == Internals::kForeignType);
681
682
683enum CompareResult {
684  LESS      = -1,
685  EQUAL     =  0,
686  GREATER   =  1,
687
688  NOT_EQUAL = GREATER
689};
690
691
692#define DECL_BOOLEAN_ACCESSORS(name)   \
693  inline bool name();                  \
694  inline void set_##name(bool value);  \
695
696
697#define DECL_ACCESSORS(name, type)                                      \
698  inline type* name();                                                  \
699  inline void set_##name(type* value,                                   \
700                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER); \
701
702
703class DictionaryElementsAccessor;
704class ElementsAccessor;
705class FixedArrayBase;
706class ObjectVisitor;
707class StringStream;
708class Failure;
709
710struct ValueInfo : public Malloced {
711  ValueInfo() : type(FIRST_TYPE), ptr(NULL), str(NULL), number(0) { }
712  InstanceType type;
713  Object* ptr;
714  const char* str;
715  double number;
716};
717
718
719// A template-ized version of the IsXXX functions.
720template <class C> static inline bool Is(Object* obj);
721
722
723class MaybeObject BASE_EMBEDDED {
724 public:
725  inline bool IsFailure();
726  inline bool IsRetryAfterGC();
727  inline bool IsOutOfMemory();
728  inline bool IsException();
729  INLINE(bool IsTheHole());
730  inline bool ToObject(Object** obj) {
731    if (IsFailure()) return false;
732    *obj = reinterpret_cast<Object*>(this);
733    return true;
734  }
735  inline Failure* ToFailureUnchecked() {
736    ASSERT(IsFailure());
737    return reinterpret_cast<Failure*>(this);
738  }
739  inline Object* ToObjectUnchecked() {
740    ASSERT(!IsFailure());
741    return reinterpret_cast<Object*>(this);
742  }
743  inline Object* ToObjectChecked() {
744    CHECK(!IsFailure());
745    return reinterpret_cast<Object*>(this);
746  }
747
748  template<typename T>
749  inline bool To(T** obj) {
750    if (IsFailure()) return false;
751    *obj = T::cast(reinterpret_cast<Object*>(this));
752    return true;
753  }
754
755#ifdef OBJECT_PRINT
756  // Prints this object with details.
757  inline void Print() {
758    Print(stdout);
759  }
760  inline void PrintLn() {
761    PrintLn(stdout);
762  }
763  void Print(FILE* out);
764  void PrintLn(FILE* out);
765#endif
766#ifdef DEBUG
767  // Verifies the object.
768  void Verify();
769#endif
770};
771
772
773#define OBJECT_TYPE_LIST(V)                    \
774  V(Smi)                                       \
775  V(HeapObject)                                \
776  V(Number)                                    \
777
778#define HEAP_OBJECT_TYPE_LIST(V)               \
779  V(HeapNumber)                                \
780  V(String)                                    \
781  V(Symbol)                                    \
782  V(SeqString)                                 \
783  V(ExternalString)                            \
784  V(ConsString)                                \
785  V(SlicedString)                              \
786  V(ExternalTwoByteString)                     \
787  V(ExternalAsciiString)                       \
788  V(SeqTwoByteString)                          \
789  V(SeqAsciiString)                            \
790                                               \
791  V(ExternalArray)                             \
792  V(ExternalByteArray)                         \
793  V(ExternalUnsignedByteArray)                 \
794  V(ExternalShortArray)                        \
795  V(ExternalUnsignedShortArray)                \
796  V(ExternalIntArray)                          \
797  V(ExternalUnsignedIntArray)                  \
798  V(ExternalFloatArray)                        \
799  V(ExternalDoubleArray)                       \
800  V(ExternalPixelArray)                        \
801  V(ByteArray)                                 \
802  V(FreeSpace)                                 \
803  V(JSReceiver)                                \
804  V(JSObject)                                  \
805  V(JSContextExtensionObject)                  \
806  V(Map)                                       \
807  V(DescriptorArray)                           \
808  V(DeoptimizationInputData)                   \
809  V(DeoptimizationOutputData)                  \
810  V(TypeFeedbackCells)                         \
811  V(FixedArray)                                \
812  V(FixedDoubleArray)                          \
813  V(Context)                                   \
814  V(GlobalContext)                             \
815  V(ScopeInfo)                                 \
816  V(JSFunction)                                \
817  V(Code)                                      \
818  V(Oddball)                                   \
819  V(SharedFunctionInfo)                        \
820  V(JSValue)                                   \
821  V(JSDate)                                    \
822  V(JSMessageObject)                           \
823  V(StringWrapper)                             \
824  V(Foreign)                                   \
825  V(Boolean)                                   \
826  V(JSArray)                                   \
827  V(JSProxy)                                   \
828  V(JSFunctionProxy)                           \
829  V(JSSet)                                     \
830  V(JSMap)                                     \
831  V(JSWeakMap)                                 \
832  V(JSRegExp)                                  \
833  V(HashTable)                                 \
834  V(Dictionary)                                \
835  V(SymbolTable)                               \
836  V(JSFunctionResultCache)                     \
837  V(NormalizedMapCache)                        \
838  V(CompilationCacheTable)                     \
839  V(CodeCacheHashTable)                        \
840  V(PolymorphicCodeCacheHashTable)             \
841  V(MapCache)                                  \
842  V(Primitive)                                 \
843  V(GlobalObject)                              \
844  V(JSGlobalObject)                            \
845  V(JSBuiltinsObject)                          \
846  V(JSGlobalProxy)                             \
847  V(UndetectableObject)                        \
848  V(AccessCheckNeeded)                         \
849  V(JSGlobalPropertyCell)                      \
850
851
852class JSReceiver;
853
854// Object is the abstract superclass for all classes in the
855// object hierarchy.
856// Object does not use any virtual functions to avoid the
857// allocation of the C++ vtable.
858// Since Smi and Failure are subclasses of Object no
859// data members can be present in Object.
860class Object : public MaybeObject {
861 public:
862  // Type testing.
863  bool IsObject() { return true; }
864
865#define IS_TYPE_FUNCTION_DECL(type_)  inline bool Is##type_();
866  OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
867  HEAP_OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
868#undef IS_TYPE_FUNCTION_DECL
869
870  inline bool IsFixedArrayBase();
871
872  // Returns true if this object is an instance of the specified
873  // function template.
874  inline bool IsInstanceOf(FunctionTemplateInfo* type);
875
876  inline bool IsStruct();
877#define DECLARE_STRUCT_PREDICATE(NAME, Name, name) inline bool Is##Name();
878  STRUCT_LIST(DECLARE_STRUCT_PREDICATE)
879#undef DECLARE_STRUCT_PREDICATE
880
881  INLINE(bool IsSpecObject());
882  INLINE(bool IsSpecFunction());
883
884  // Oddball testing.
885  INLINE(bool IsUndefined());
886  INLINE(bool IsNull());
887  INLINE(bool IsTheHole());  // Shadows MaybeObject's implementation.
888  INLINE(bool IsTrue());
889  INLINE(bool IsFalse());
890  inline bool IsArgumentsMarker();
891  inline bool NonFailureIsHeapObject();
892
893  // Filler objects (fillers and free space objects).
894  inline bool IsFiller();
895
896  // Extract the number.
897  inline double Number();
898  inline bool IsNaN();
899
900  // Returns true if the object is of the correct type to be used as a
901  // implementation of a JSObject's elements.
902  inline bool HasValidElements();
903
904  inline bool HasSpecificClassOf(String* name);
905
906  MUST_USE_RESULT MaybeObject* ToObject();             // ECMA-262 9.9.
907  Object* ToBoolean();                                 // ECMA-262 9.2.
908
909  // Convert to a JSObject if needed.
910  // global_context is used when creating wrapper object.
911  MUST_USE_RESULT MaybeObject* ToObject(Context* global_context);
912
913  // Converts this to a Smi if possible.
914  // Failure is returned otherwise.
915  MUST_USE_RESULT inline MaybeObject* ToSmi();
916
917  void Lookup(String* name, LookupResult* result);
918
919  // Property access.
920  MUST_USE_RESULT inline MaybeObject* GetProperty(String* key);
921  MUST_USE_RESULT inline MaybeObject* GetProperty(
922      String* key,
923      PropertyAttributes* attributes);
924  MUST_USE_RESULT MaybeObject* GetPropertyWithReceiver(
925      Object* receiver,
926      String* key,
927      PropertyAttributes* attributes);
928
929  static Handle<Object> GetProperty(Handle<Object> object,
930                                    Handle<Object> receiver,
931                                    LookupResult* result,
932                                    Handle<String> key,
933                                    PropertyAttributes* attributes);
934
935  MUST_USE_RESULT MaybeObject* GetProperty(Object* receiver,
936                                           LookupResult* result,
937                                           String* key,
938                                           PropertyAttributes* attributes);
939
940  MUST_USE_RESULT MaybeObject* GetPropertyWithDefinedGetter(Object* receiver,
941                                                            JSReceiver* getter);
942
943  static Handle<Object> GetElement(Handle<Object> object, uint32_t index);
944  MUST_USE_RESULT inline MaybeObject* GetElement(uint32_t index);
945  // For use when we know that no exception can be thrown.
946  inline Object* GetElementNoExceptionThrown(uint32_t index);
947  MUST_USE_RESULT MaybeObject* GetElementWithReceiver(Object* receiver,
948                                                      uint32_t index);
949
950  // Return the object's prototype (might be Heap::null_value()).
951  Object* GetPrototype();
952
953  // Returns the permanent hash code associated with this object depending on
954  // the actual object type.  Might return a failure in case no hash was
955  // created yet or GC was caused by creation.
956  MUST_USE_RESULT MaybeObject* GetHash(CreationFlag flag);
957
958  // Checks whether this object has the same value as the given one.  This
959  // function is implemented according to ES5, section 9.12 and can be used
960  // to implement the Harmony "egal" function.
961  bool SameValue(Object* other);
962
963  // Tries to convert an object to an array index.  Returns true and sets
964  // the output parameter if it succeeds.
965  inline bool ToArrayIndex(uint32_t* index);
966
967  // Returns true if this is a JSValue containing a string and the index is
968  // < the length of the string.  Used to implement [] on strings.
969  inline bool IsStringObjectWithCharacterAt(uint32_t index);
970
971#ifdef DEBUG
972  // Verify a pointer is a valid object pointer.
973  static void VerifyPointer(Object* p);
974#endif
975
976  // Prints this object without details.
977  inline void ShortPrint() {
978    ShortPrint(stdout);
979  }
980  void ShortPrint(FILE* out);
981
982  // Prints this object without details to a message accumulator.
983  void ShortPrint(StringStream* accumulator);
984
985  // Casting: This cast is only needed to satisfy macros in objects-inl.h.
986  static Object* cast(Object* value) { return value; }
987
988  // Layout description.
989  static const int kHeaderSize = 0;  // Object does not take up any space.
990
991 private:
992  DISALLOW_IMPLICIT_CONSTRUCTORS(Object);
993};
994
995
996// Smi represents integer Numbers that can be stored in 31 bits.
997// Smis are immediate which means they are NOT allocated in the heap.
998// The this pointer has the following format: [31 bit signed int] 0
999// For long smis it has the following format:
1000//     [32 bit signed int] [31 bits zero padding] 0
1001// Smi stands for small integer.
1002class Smi: public Object {
1003 public:
1004  // Returns the integer value.
1005  inline int value();
1006
1007  // Convert a value to a Smi object.
1008  static inline Smi* FromInt(int value);
1009
1010  static inline Smi* FromIntptr(intptr_t value);
1011
1012  // Returns whether value can be represented in a Smi.
1013  static inline bool IsValid(intptr_t value);
1014
1015  // Casting.
1016  static inline Smi* cast(Object* object);
1017
1018  // Dispatched behavior.
1019  inline void SmiPrint() {
1020    SmiPrint(stdout);
1021  }
1022  void SmiPrint(FILE* out);
1023  void SmiPrint(StringStream* accumulator);
1024#ifdef DEBUG
1025  void SmiVerify();
1026#endif
1027
1028  static const int kMinValue =
1029      (static_cast<unsigned int>(-1)) << (kSmiValueSize - 1);
1030  static const int kMaxValue = -(kMinValue + 1);
1031
1032 private:
1033  DISALLOW_IMPLICIT_CONSTRUCTORS(Smi);
1034};
1035
1036
1037// Failure is used for reporting out of memory situations and
1038// propagating exceptions through the runtime system.  Failure objects
1039// are transient and cannot occur as part of the object graph.
1040//
1041// Failures are a single word, encoded as follows:
1042// +-------------------------+---+--+--+
1043// |.........unused..........|sss|tt|11|
1044// +-------------------------+---+--+--+
1045//                          7 6 4 32 10
1046//
1047//
1048// The low two bits, 0-1, are the failure tag, 11.  The next two bits,
1049// 2-3, are a failure type tag 'tt' with possible values:
1050//   00 RETRY_AFTER_GC
1051//   01 EXCEPTION
1052//   10 INTERNAL_ERROR
1053//   11 OUT_OF_MEMORY_EXCEPTION
1054//
1055// The next three bits, 4-6, are an allocation space tag 'sss'.  The
1056// allocation space tag is 000 for all failure types except
1057// RETRY_AFTER_GC.  For RETRY_AFTER_GC, the possible values are the
1058// allocation spaces (the encoding is found in globals.h).
1059
1060// Failure type tag info.
1061const int kFailureTypeTagSize = 2;
1062const int kFailureTypeTagMask = (1 << kFailureTypeTagSize) - 1;
1063
1064class Failure: public MaybeObject {
1065 public:
1066  // RuntimeStubs assumes EXCEPTION = 1 in the compiler-generated code.
1067  enum Type {
1068    RETRY_AFTER_GC = 0,
1069    EXCEPTION = 1,       // Returning this marker tells the real exception
1070                         // is in Isolate::pending_exception.
1071    INTERNAL_ERROR = 2,
1072    OUT_OF_MEMORY_EXCEPTION = 3
1073  };
1074
1075  inline Type type() const;
1076
1077  // Returns the space that needs to be collected for RetryAfterGC failures.
1078  inline AllocationSpace allocation_space() const;
1079
1080  inline bool IsInternalError() const;
1081  inline bool IsOutOfMemoryException() const;
1082
1083  static inline Failure* RetryAfterGC(AllocationSpace space);
1084  static inline Failure* RetryAfterGC();  // NEW_SPACE
1085  static inline Failure* Exception();
1086  static inline Failure* InternalError();
1087  static inline Failure* OutOfMemoryException();
1088  // Casting.
1089  static inline Failure* cast(MaybeObject* object);
1090
1091  // Dispatched behavior.
1092  inline void FailurePrint() {
1093    FailurePrint(stdout);
1094  }
1095  void FailurePrint(FILE* out);
1096  void FailurePrint(StringStream* accumulator);
1097#ifdef DEBUG
1098  void FailureVerify();
1099#endif
1100
1101 private:
1102  inline intptr_t value() const;
1103  static inline Failure* Construct(Type type, intptr_t value = 0);
1104
1105  DISALLOW_IMPLICIT_CONSTRUCTORS(Failure);
1106};
1107
1108
1109// Heap objects typically have a map pointer in their first word.  However,
1110// during GC other data (e.g. mark bits, forwarding addresses) is sometimes
1111// encoded in the first word.  The class MapWord is an abstraction of the
1112// value in a heap object's first word.
1113class MapWord BASE_EMBEDDED {
1114 public:
1115  // Normal state: the map word contains a map pointer.
1116
1117  // Create a map word from a map pointer.
1118  static inline MapWord FromMap(Map* map);
1119
1120  // View this map word as a map pointer.
1121  inline Map* ToMap();
1122
1123
1124  // Scavenge collection: the map word of live objects in the from space
1125  // contains a forwarding address (a heap object pointer in the to space).
1126
1127  // True if this map word is a forwarding address for a scavenge
1128  // collection.  Only valid during a scavenge collection (specifically,
1129  // when all map words are heap object pointers, i.e. not during a full GC).
1130  inline bool IsForwardingAddress();
1131
1132  // Create a map word from a forwarding address.
1133  static inline MapWord FromForwardingAddress(HeapObject* object);
1134
1135  // View this map word as a forwarding address.
1136  inline HeapObject* ToForwardingAddress();
1137
1138  static inline MapWord FromRawValue(uintptr_t value) {
1139    return MapWord(value);
1140  }
1141
1142  inline uintptr_t ToRawValue() {
1143    return value_;
1144  }
1145
1146 private:
1147  // HeapObject calls the private constructor and directly reads the value.
1148  friend class HeapObject;
1149
1150  explicit MapWord(uintptr_t value) : value_(value) {}
1151
1152  uintptr_t value_;
1153};
1154
1155
1156// HeapObject is the superclass for all classes describing heap allocated
1157// objects.
1158class HeapObject: public Object {
1159 public:
1160  // [map]: Contains a map which contains the object's reflective
1161  // information.
1162  inline Map* map();
1163  inline void set_map(Map* value);
1164  // The no-write-barrier version.  This is OK if the object is white and in
1165  // new space, or if the value is an immortal immutable object, like the maps
1166  // of primitive (non-JS) objects like strings, heap numbers etc.
1167  inline void set_map_no_write_barrier(Map* value);
1168
1169  // During garbage collection, the map word of a heap object does not
1170  // necessarily contain a map pointer.
1171  inline MapWord map_word();
1172  inline void set_map_word(MapWord map_word);
1173
1174  // The Heap the object was allocated in. Used also to access Isolate.
1175  inline Heap* GetHeap();
1176
1177  // Convenience method to get current isolate. This method can be
1178  // accessed only when its result is the same as
1179  // Isolate::Current(), it ASSERTs this. See also comment for GetHeap.
1180  inline Isolate* GetIsolate();
1181
1182  // Converts an address to a HeapObject pointer.
1183  static inline HeapObject* FromAddress(Address address);
1184
1185  // Returns the address of this HeapObject.
1186  inline Address address();
1187
1188  // Iterates over pointers contained in the object (including the Map)
1189  void Iterate(ObjectVisitor* v);
1190
1191  // Iterates over all pointers contained in the object except the
1192  // first map pointer.  The object type is given in the first
1193  // parameter. This function does not access the map pointer in the
1194  // object, and so is safe to call while the map pointer is modified.
1195  void IterateBody(InstanceType type, int object_size, ObjectVisitor* v);
1196
1197  // Returns the heap object's size in bytes
1198  inline int Size();
1199
1200  // Given a heap object's map pointer, returns the heap size in bytes
1201  // Useful when the map pointer field is used for other purposes.
1202  // GC internal.
1203  inline int SizeFromMap(Map* map);
1204
1205  // Returns the field at offset in obj, as a read/write Object* reference.
1206  // Does no checking, and is safe to use during GC, while maps are invalid.
1207  // Does not invoke write barrier, so should only be assigned to
1208  // during marking GC.
1209  static inline Object** RawField(HeapObject* obj, int offset);
1210
1211  // Casting.
1212  static inline HeapObject* cast(Object* obj);
1213
1214  // Return the write barrier mode for this. Callers of this function
1215  // must be able to present a reference to an AssertNoAllocation
1216  // object as a sign that they are not going to use this function
1217  // from code that allocates and thus invalidates the returned write
1218  // barrier mode.
1219  inline WriteBarrierMode GetWriteBarrierMode(const AssertNoAllocation&);
1220
1221  // Dispatched behavior.
1222  void HeapObjectShortPrint(StringStream* accumulator);
1223#ifdef OBJECT_PRINT
1224  inline void HeapObjectPrint() {
1225    HeapObjectPrint(stdout);
1226  }
1227  void HeapObjectPrint(FILE* out);
1228  void PrintHeader(FILE* out, const char* id);
1229#endif
1230
1231#ifdef DEBUG
1232  void HeapObjectVerify();
1233  inline void VerifyObjectField(int offset);
1234  inline void VerifySmiField(int offset);
1235
1236  // Verify a pointer is a valid HeapObject pointer that points to object
1237  // areas in the heap.
1238  static void VerifyHeapPointer(Object* p);
1239#endif
1240
1241  // Layout description.
1242  // First field in a heap object is map.
1243  static const int kMapOffset = Object::kHeaderSize;
1244  static const int kHeaderSize = kMapOffset + kPointerSize;
1245
1246  STATIC_CHECK(kMapOffset == Internals::kHeapObjectMapOffset);
1247
1248 protected:
1249  // helpers for calling an ObjectVisitor to iterate over pointers in the
1250  // half-open range [start, end) specified as integer offsets
1251  inline void IteratePointers(ObjectVisitor* v, int start, int end);
1252  // as above, for the single element at "offset"
1253  inline void IteratePointer(ObjectVisitor* v, int offset);
1254
1255 private:
1256  DISALLOW_IMPLICIT_CONSTRUCTORS(HeapObject);
1257};
1258
1259
1260#define SLOT_ADDR(obj, offset) \
1261  reinterpret_cast<Object**>((obj)->address() + offset)
1262
1263// This class describes a body of an object of a fixed size
1264// in which all pointer fields are located in the [start_offset, end_offset)
1265// interval.
1266template<int start_offset, int end_offset, int size>
1267class FixedBodyDescriptor {
1268 public:
1269  static const int kStartOffset = start_offset;
1270  static const int kEndOffset = end_offset;
1271  static const int kSize = size;
1272
1273  static inline void IterateBody(HeapObject* obj, ObjectVisitor* v);
1274
1275  template<typename StaticVisitor>
1276  static inline void IterateBody(HeapObject* obj) {
1277    StaticVisitor::VisitPointers(SLOT_ADDR(obj, start_offset),
1278                                 SLOT_ADDR(obj, end_offset));
1279  }
1280};
1281
1282
1283// This class describes a body of an object of a variable size
1284// in which all pointer fields are located in the [start_offset, object_size)
1285// interval.
1286template<int start_offset>
1287class FlexibleBodyDescriptor {
1288 public:
1289  static const int kStartOffset = start_offset;
1290
1291  static inline void IterateBody(HeapObject* obj,
1292                                 int object_size,
1293                                 ObjectVisitor* v);
1294
1295  template<typename StaticVisitor>
1296  static inline void IterateBody(HeapObject* obj, int object_size) {
1297    StaticVisitor::VisitPointers(SLOT_ADDR(obj, start_offset),
1298                                 SLOT_ADDR(obj, object_size));
1299  }
1300};
1301
1302#undef SLOT_ADDR
1303
1304
1305// The HeapNumber class describes heap allocated numbers that cannot be
1306// represented in a Smi (small integer)
1307class HeapNumber: public HeapObject {
1308 public:
1309  // [value]: number value.
1310  inline double value();
1311  inline void set_value(double value);
1312
1313  // Casting.
1314  static inline HeapNumber* cast(Object* obj);
1315
1316  // Dispatched behavior.
1317  Object* HeapNumberToBoolean();
1318  inline void HeapNumberPrint() {
1319    HeapNumberPrint(stdout);
1320  }
1321  void HeapNumberPrint(FILE* out);
1322  void HeapNumberPrint(StringStream* accumulator);
1323#ifdef DEBUG
1324  void HeapNumberVerify();
1325#endif
1326
1327  inline int get_exponent();
1328  inline int get_sign();
1329
1330  // Layout description.
1331  static const int kValueOffset = HeapObject::kHeaderSize;
1332  // IEEE doubles are two 32 bit words.  The first is just mantissa, the second
1333  // is a mixture of sign, exponent and mantissa.  Our current platforms are all
1334  // little endian apart from non-EABI arm which is little endian with big
1335  // endian floating point word ordering!
1336  static const int kMantissaOffset = kValueOffset;
1337  static const int kExponentOffset = kValueOffset + 4;
1338
1339  static const int kSize = kValueOffset + kDoubleSize;
1340  static const uint32_t kSignMask = 0x80000000u;
1341  static const uint32_t kExponentMask = 0x7ff00000u;
1342  static const uint32_t kMantissaMask = 0xfffffu;
1343  static const int kMantissaBits = 52;
1344  static const int kExponentBits = 11;
1345  static const int kExponentBias = 1023;
1346  static const int kExponentShift = 20;
1347  static const int kMantissaBitsInTopWord = 20;
1348  static const int kNonMantissaBitsInTopWord = 12;
1349
1350 private:
1351  DISALLOW_IMPLICIT_CONSTRUCTORS(HeapNumber);
1352};
1353
1354
1355enum EnsureElementsMode {
1356  DONT_ALLOW_DOUBLE_ELEMENTS,
1357  ALLOW_COPIED_DOUBLE_ELEMENTS,
1358  ALLOW_CONVERTED_DOUBLE_ELEMENTS
1359};
1360
1361
1362// Indicates whether a property should be set or (re)defined.  Setting of a
1363// property causes attributes to remain unchanged, writability to be checked
1364// and callbacks to be called.  Defining of a property causes attributes to
1365// be updated and callbacks to be overridden.
1366enum SetPropertyMode {
1367  SET_PROPERTY,
1368  DEFINE_PROPERTY
1369};
1370
1371
1372// Indicator for one component of an AccessorPair.
1373enum AccessorComponent {
1374  ACCESSOR_GETTER,
1375  ACCESSOR_SETTER
1376};
1377
1378
1379// JSReceiver includes types on which properties can be defined, i.e.,
1380// JSObject and JSProxy.
1381class JSReceiver: public HeapObject {
1382 public:
1383  enum DeleteMode {
1384    NORMAL_DELETION,
1385    STRICT_DELETION,
1386    FORCE_DELETION
1387  };
1388
1389  // Casting.
1390  static inline JSReceiver* cast(Object* obj);
1391
1392  static Handle<Object> SetProperty(Handle<JSReceiver> object,
1393                                    Handle<String> key,
1394                                    Handle<Object> value,
1395                                    PropertyAttributes attributes,
1396                                    StrictModeFlag strict_mode);
1397  // Can cause GC.
1398  MUST_USE_RESULT MaybeObject* SetProperty(String* key,
1399                                           Object* value,
1400                                           PropertyAttributes attributes,
1401                                           StrictModeFlag strict_mode);
1402  MUST_USE_RESULT MaybeObject* SetProperty(LookupResult* result,
1403                                           String* key,
1404                                           Object* value,
1405                                           PropertyAttributes attributes,
1406                                           StrictModeFlag strict_mode);
1407  MUST_USE_RESULT MaybeObject* SetPropertyWithDefinedSetter(JSReceiver* setter,
1408                                                            Object* value);
1409
1410  MUST_USE_RESULT MaybeObject* DeleteProperty(String* name, DeleteMode mode);
1411  MUST_USE_RESULT MaybeObject* DeleteElement(uint32_t index, DeleteMode mode);
1412
1413  // Set the index'th array element.
1414  // Can cause GC, or return failure if GC is required.
1415  MUST_USE_RESULT MaybeObject* SetElement(uint32_t index,
1416                                          Object* value,
1417                                          PropertyAttributes attributes,
1418                                          StrictModeFlag strict_mode,
1419                                          bool check_prototype);
1420
1421  // Tests for the fast common case for property enumeration.
1422  bool IsSimpleEnum();
1423
1424  // Returns the class name ([[Class]] property in the specification).
1425  String* class_name();
1426
1427  // Returns the constructor name (the name (possibly, inferred name) of the
1428  // function that was used to instantiate the object).
1429  String* constructor_name();
1430
1431  inline PropertyAttributes GetPropertyAttribute(String* name);
1432  PropertyAttributes GetPropertyAttributeWithReceiver(JSReceiver* receiver,
1433                                                      String* name);
1434  PropertyAttributes GetLocalPropertyAttribute(String* name);
1435
1436  // Can cause a GC.
1437  inline bool HasProperty(String* name);
1438  inline bool HasLocalProperty(String* name);
1439  inline bool HasElement(uint32_t index);
1440
1441  // Return the object's prototype (might be Heap::null_value()).
1442  inline Object* GetPrototype();
1443
1444  // Set the object's prototype (only JSReceiver and null are allowed).
1445  MUST_USE_RESULT MaybeObject* SetPrototype(Object* value,
1446                                            bool skip_hidden_prototypes);
1447
1448  // Retrieves a permanent object identity hash code. The undefined value might
1449  // be returned in case no hash was created yet and OMIT_CREATION was used.
1450  inline MUST_USE_RESULT MaybeObject* GetIdentityHash(CreationFlag flag);
1451
1452  // Lookup a property.  If found, the result is valid and has
1453  // detailed information.
1454  void LocalLookup(String* name, LookupResult* result);
1455  void Lookup(String* name, LookupResult* result);
1456
1457 protected:
1458  Smi* GenerateIdentityHash();
1459
1460 private:
1461  PropertyAttributes GetPropertyAttribute(JSReceiver* receiver,
1462                                          LookupResult* result,
1463                                          String* name,
1464                                          bool continue_search);
1465
1466  DISALLOW_IMPLICIT_CONSTRUCTORS(JSReceiver);
1467};
1468
1469// The JSObject describes real heap allocated JavaScript objects with
1470// properties.
1471// Note that the map of JSObject changes during execution to enable inline
1472// caching.
1473class JSObject: public JSReceiver {
1474 public:
1475  // [properties]: Backing storage for properties.
1476  // properties is a FixedArray in the fast case and a Dictionary in the
1477  // slow case.
1478  DECL_ACCESSORS(properties, FixedArray)  // Get and set fast properties.
1479  inline void initialize_properties();
1480  inline bool HasFastProperties();
1481  inline StringDictionary* property_dictionary();  // Gets slow properties.
1482
1483  // [elements]: The elements (properties with names that are integers).
1484  //
1485  // Elements can be in two general modes: fast and slow. Each mode
1486  // corrensponds to a set of object representations of elements that
1487  // have something in common.
1488  //
1489  // In the fast mode elements is a FixedArray and so each element can
1490  // be quickly accessed. This fact is used in the generated code. The
1491  // elements array can have one of three maps in this mode:
1492  // fixed_array_map, non_strict_arguments_elements_map or
1493  // fixed_cow_array_map (for copy-on-write arrays). In the latter case
1494  // the elements array may be shared by a few objects and so before
1495  // writing to any element the array must be copied. Use
1496  // EnsureWritableFastElements in this case.
1497  //
1498  // In the slow mode the elements is either a NumberDictionary, an
1499  // ExternalArray, or a FixedArray parameter map for a (non-strict)
1500  // arguments object.
1501  DECL_ACCESSORS(elements, FixedArrayBase)
1502  inline void initialize_elements();
1503  MUST_USE_RESULT inline MaybeObject* ResetElements();
1504  inline ElementsKind GetElementsKind();
1505  inline ElementsAccessor* GetElementsAccessor();
1506  inline bool HasFastSmiOnlyElements();
1507  inline bool HasFastElements();
1508  // Returns if an object has either FAST_ELEMENT or FAST_SMI_ONLY_ELEMENT
1509  // elements.  TODO(danno): Rename HasFastTypeElements to HasFastElements() and
1510  // HasFastElements to HasFastObjectElements.
1511  inline bool HasFastTypeElements();
1512  inline bool HasFastDoubleElements();
1513  inline bool HasNonStrictArgumentsElements();
1514  inline bool HasDictionaryElements();
1515  inline bool HasExternalPixelElements();
1516  inline bool HasExternalArrayElements();
1517  inline bool HasExternalByteElements();
1518  inline bool HasExternalUnsignedByteElements();
1519  inline bool HasExternalShortElements();
1520  inline bool HasExternalUnsignedShortElements();
1521  inline bool HasExternalIntElements();
1522  inline bool HasExternalUnsignedIntElements();
1523  inline bool HasExternalFloatElements();
1524  inline bool HasExternalDoubleElements();
1525  bool HasFastArgumentsElements();
1526  bool HasDictionaryArgumentsElements();
1527  inline SeededNumberDictionary* element_dictionary();  // Gets slow elements.
1528
1529  inline void set_map_and_elements(
1530      Map* map,
1531      FixedArrayBase* value,
1532      WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
1533
1534  // Requires: HasFastElements().
1535  MUST_USE_RESULT inline MaybeObject* EnsureWritableFastElements();
1536
1537  // Collects elements starting at index 0.
1538  // Undefined values are placed after non-undefined values.
1539  // Returns the number of non-undefined values.
1540  MUST_USE_RESULT MaybeObject* PrepareElementsForSort(uint32_t limit);
1541  // As PrepareElementsForSort, but only on objects where elements is
1542  // a dictionary, and it will stay a dictionary.
1543  MUST_USE_RESULT MaybeObject* PrepareSlowElementsForSort(uint32_t limit);
1544
1545  MUST_USE_RESULT MaybeObject* GetPropertyWithCallback(Object* receiver,
1546                                                       Object* structure,
1547                                                       String* name);
1548
1549  // Can cause GC.
1550  MUST_USE_RESULT MaybeObject* SetPropertyForResult(LookupResult* result,
1551                                           String* key,
1552                                           Object* value,
1553                                           PropertyAttributes attributes,
1554                                           StrictModeFlag strict_mode);
1555  MUST_USE_RESULT MaybeObject* SetPropertyWithFailedAccessCheck(
1556      LookupResult* result,
1557      String* name,
1558      Object* value,
1559      bool check_prototype,
1560      StrictModeFlag strict_mode);
1561  MUST_USE_RESULT MaybeObject* SetPropertyWithCallback(
1562      Object* structure,
1563      String* name,
1564      Object* value,
1565      JSObject* holder,
1566      StrictModeFlag strict_mode);
1567  MUST_USE_RESULT MaybeObject* SetPropertyWithInterceptor(
1568      String* name,
1569      Object* value,
1570      PropertyAttributes attributes,
1571      StrictModeFlag strict_mode);
1572  MUST_USE_RESULT MaybeObject* SetPropertyPostInterceptor(
1573      String* name,
1574      Object* value,
1575      PropertyAttributes attributes,
1576      StrictModeFlag strict_mode);
1577
1578  static Handle<Object> SetLocalPropertyIgnoreAttributes(
1579      Handle<JSObject> object,
1580      Handle<String> key,
1581      Handle<Object> value,
1582      PropertyAttributes attributes);
1583
1584  // Can cause GC.
1585  MUST_USE_RESULT MaybeObject* SetLocalPropertyIgnoreAttributes(
1586      String* key,
1587      Object* value,
1588      PropertyAttributes attributes);
1589
1590  // Retrieve a value in a normalized object given a lookup result.
1591  // Handles the special representation of JS global objects.
1592  Object* GetNormalizedProperty(LookupResult* result);
1593
1594  // Sets the property value in a normalized object given a lookup result.
1595  // Handles the special representation of JS global objects.
1596  Object* SetNormalizedProperty(LookupResult* result, Object* value);
1597
1598  // Sets the property value in a normalized object given (key, value, details).
1599  // Handles the special representation of JS global objects.
1600  static Handle<Object> SetNormalizedProperty(Handle<JSObject> object,
1601                                              Handle<String> key,
1602                                              Handle<Object> value,
1603                                              PropertyDetails details);
1604
1605  MUST_USE_RESULT MaybeObject* SetNormalizedProperty(String* name,
1606                                                     Object* value,
1607                                                     PropertyDetails details);
1608
1609  // Deletes the named property in a normalized object.
1610  MUST_USE_RESULT MaybeObject* DeleteNormalizedProperty(String* name,
1611                                                        DeleteMode mode);
1612
1613  // Retrieve interceptors.
1614  InterceptorInfo* GetNamedInterceptor();
1615  InterceptorInfo* GetIndexedInterceptor();
1616
1617  // Used from JSReceiver.
1618  PropertyAttributes GetPropertyAttributePostInterceptor(JSObject* receiver,
1619                                                         String* name,
1620                                                         bool continue_search);
1621  PropertyAttributes GetPropertyAttributeWithInterceptor(JSObject* receiver,
1622                                                         String* name,
1623                                                         bool continue_search);
1624  PropertyAttributes GetPropertyAttributeWithFailedAccessCheck(
1625      Object* receiver,
1626      LookupResult* result,
1627      String* name,
1628      bool continue_search);
1629
1630  static void DefineAccessor(Handle<JSObject> object,
1631                             Handle<String> name,
1632                             Handle<Object> getter,
1633                             Handle<Object> setter,
1634                             PropertyAttributes attributes);
1635  MUST_USE_RESULT MaybeObject* DefineAccessor(String* name,
1636                                              Object* getter,
1637                                              Object* setter,
1638                                              PropertyAttributes attributes);
1639  Object* LookupAccessor(String* name, AccessorComponent component);
1640
1641  MUST_USE_RESULT MaybeObject* DefineAccessor(AccessorInfo* info);
1642
1643  // Used from Object::GetProperty().
1644  MUST_USE_RESULT MaybeObject* GetPropertyWithFailedAccessCheck(
1645      Object* receiver,
1646      LookupResult* result,
1647      String* name,
1648      PropertyAttributes* attributes);
1649  MUST_USE_RESULT MaybeObject* GetPropertyWithInterceptor(
1650      JSReceiver* receiver,
1651      String* name,
1652      PropertyAttributes* attributes);
1653  MUST_USE_RESULT MaybeObject* GetPropertyPostInterceptor(
1654      JSReceiver* receiver,
1655      String* name,
1656      PropertyAttributes* attributes);
1657  MUST_USE_RESULT MaybeObject* GetLocalPropertyPostInterceptor(
1658      JSReceiver* receiver,
1659      String* name,
1660      PropertyAttributes* attributes);
1661
1662  // Returns true if this is an instance of an api function and has
1663  // been modified since it was created.  May give false positives.
1664  bool IsDirty();
1665
1666  // If the receiver is a JSGlobalProxy this method will return its prototype,
1667  // otherwise the result is the receiver itself.
1668  inline Object* BypassGlobalProxy();
1669
1670  // Accessors for hidden properties object.
1671  //
1672  // Hidden properties are not local properties of the object itself.
1673  // Instead they are stored in an auxiliary structure kept as a local
1674  // property with a special name Heap::hidden_symbol(). But if the
1675  // receiver is a JSGlobalProxy then the auxiliary object is a property
1676  // of its prototype, and if it's a detached proxy, then you can't have
1677  // hidden properties.
1678
1679  // Sets a hidden property on this object. Returns this object if successful,
1680  // undefined if called on a detached proxy.
1681  static Handle<Object> SetHiddenProperty(Handle<JSObject> obj,
1682                                          Handle<String> key,
1683                                          Handle<Object> value);
1684  // Returns a failure if a GC is required.
1685  MUST_USE_RESULT MaybeObject* SetHiddenProperty(String* key, Object* value);
1686  // Gets the value of a hidden property with the given key. Returns undefined
1687  // if the property doesn't exist (or if called on a detached proxy),
1688  // otherwise returns the value set for the key.
1689  Object* GetHiddenProperty(String* key);
1690  // Deletes a hidden property. Deleting a non-existing property is
1691  // considered successful.
1692  void DeleteHiddenProperty(String* key);
1693  // Returns true if the object has a property with the hidden symbol as name.
1694  bool HasHiddenProperties();
1695
1696  static int GetIdentityHash(Handle<JSObject> obj);
1697  MUST_USE_RESULT MaybeObject* GetIdentityHash(CreationFlag flag);
1698  MUST_USE_RESULT MaybeObject* SetIdentityHash(Object* hash, CreationFlag flag);
1699
1700  static Handle<Object> DeleteProperty(Handle<JSObject> obj,
1701                                       Handle<String> name);
1702  MUST_USE_RESULT MaybeObject* DeleteProperty(String* name, DeleteMode mode);
1703
1704  static Handle<Object> DeleteElement(Handle<JSObject> obj, uint32_t index);
1705  MUST_USE_RESULT MaybeObject* DeleteElement(uint32_t index, DeleteMode mode);
1706
1707  inline void ValidateSmiOnlyElements();
1708
1709  // Makes sure that this object can contain HeapObject as elements.
1710  MUST_USE_RESULT inline MaybeObject* EnsureCanContainHeapObjectElements();
1711
1712  // Makes sure that this object can contain the specified elements.
1713  MUST_USE_RESULT inline MaybeObject* EnsureCanContainElements(
1714      Object** elements,
1715      uint32_t count,
1716      EnsureElementsMode mode);
1717  MUST_USE_RESULT inline MaybeObject* EnsureCanContainElements(
1718      FixedArrayBase* elements,
1719      EnsureElementsMode mode);
1720  MUST_USE_RESULT MaybeObject* EnsureCanContainElements(
1721      Arguments* arguments,
1722      uint32_t first_arg,
1723      uint32_t arg_count,
1724      EnsureElementsMode mode);
1725
1726  // Do we want to keep the elements in fast case when increasing the
1727  // capacity?
1728  bool ShouldConvertToSlowElements(int new_capacity);
1729  // Returns true if the backing storage for the slow-case elements of
1730  // this object takes up nearly as much space as a fast-case backing
1731  // storage would.  In that case the JSObject should have fast
1732  // elements.
1733  bool ShouldConvertToFastElements();
1734  // Returns true if the elements of JSObject contains only values that can be
1735  // represented in a FixedDoubleArray and has at least one value that can only
1736  // be represented as a double and not a Smi.
1737  bool ShouldConvertToFastDoubleElements(bool* has_smi_only_elements);
1738
1739  // Tells whether the index'th element is present.
1740  bool HasElementWithReceiver(JSReceiver* receiver, uint32_t index);
1741
1742  // Computes the new capacity when expanding the elements of a JSObject.
1743  static int NewElementsCapacity(int old_capacity) {
1744    // (old_capacity + 50%) + 16
1745    return old_capacity + (old_capacity >> 1) + 16;
1746  }
1747
1748  // Tells whether the index'th element is present and how it is stored.
1749  enum LocalElementType {
1750    // There is no element with given index.
1751    UNDEFINED_ELEMENT,
1752
1753    // Element with given index is handled by interceptor.
1754    INTERCEPTED_ELEMENT,
1755
1756    // Element with given index is character in string.
1757    STRING_CHARACTER_ELEMENT,
1758
1759    // Element with given index is stored in fast backing store.
1760    FAST_ELEMENT,
1761
1762    // Element with given index is stored in slow backing store.
1763    DICTIONARY_ELEMENT
1764  };
1765
1766  LocalElementType HasLocalElement(uint32_t index);
1767
1768  bool HasElementWithInterceptor(JSReceiver* receiver, uint32_t index);
1769
1770  MUST_USE_RESULT MaybeObject* SetFastElement(uint32_t index,
1771                                              Object* value,
1772                                              StrictModeFlag strict_mode,
1773                                              bool check_prototype);
1774
1775  MUST_USE_RESULT MaybeObject* SetDictionaryElement(
1776      uint32_t index,
1777      Object* value,
1778      PropertyAttributes attributes,
1779      StrictModeFlag strict_mode,
1780      bool check_prototype,
1781      SetPropertyMode set_mode = SET_PROPERTY);
1782
1783  MUST_USE_RESULT MaybeObject* SetFastDoubleElement(
1784      uint32_t index,
1785      Object* value,
1786      StrictModeFlag strict_mode,
1787      bool check_prototype = true);
1788
1789  static Handle<Object> SetOwnElement(Handle<JSObject> object,
1790                                      uint32_t index,
1791                                      Handle<Object> value,
1792                                      StrictModeFlag strict_mode);
1793
1794  // Empty handle is returned if the element cannot be set to the given value.
1795  static MUST_USE_RESULT Handle<Object> SetElement(
1796      Handle<JSObject> object,
1797      uint32_t index,
1798      Handle<Object> value,
1799      PropertyAttributes attr,
1800      StrictModeFlag strict_mode,
1801      SetPropertyMode set_mode = SET_PROPERTY);
1802
1803  // A Failure object is returned if GC is needed.
1804  MUST_USE_RESULT MaybeObject* SetElement(
1805      uint32_t index,
1806      Object* value,
1807      PropertyAttributes attributes,
1808      StrictModeFlag strict_mode,
1809      bool check_prototype = true,
1810      SetPropertyMode set_mode = SET_PROPERTY);
1811
1812  // Returns the index'th element.
1813  // The undefined object if index is out of bounds.
1814  MUST_USE_RESULT MaybeObject* GetElementWithInterceptor(Object* receiver,
1815                                                         uint32_t index);
1816
1817  enum SetFastElementsCapacityMode {
1818    kAllowSmiOnlyElements,
1819    kForceSmiOnlyElements,
1820    kDontAllowSmiOnlyElements
1821  };
1822
1823  // Replace the elements' backing store with fast elements of the given
1824  // capacity.  Update the length for JSArrays.  Returns the new backing
1825  // store.
1826  MUST_USE_RESULT MaybeObject* SetFastElementsCapacityAndLength(
1827      int capacity,
1828      int length,
1829      SetFastElementsCapacityMode set_capacity_mode);
1830  MUST_USE_RESULT MaybeObject* SetFastDoubleElementsCapacityAndLength(
1831      int capacity,
1832      int length);
1833
1834  // Lookup interceptors are used for handling properties controlled by host
1835  // objects.
1836  inline bool HasNamedInterceptor();
1837  inline bool HasIndexedInterceptor();
1838
1839  // Support functions for v8 api (needed for correct interceptor behavior).
1840  bool HasRealNamedProperty(String* key);
1841  bool HasRealElementProperty(uint32_t index);
1842  bool HasRealNamedCallbackProperty(String* key);
1843
1844  // Get the header size for a JSObject.  Used to compute the index of
1845  // internal fields as well as the number of internal fields.
1846  inline int GetHeaderSize();
1847
1848  inline int GetInternalFieldCount();
1849  inline int GetInternalFieldOffset(int index);
1850  inline Object* GetInternalField(int index);
1851  inline void SetInternalField(int index, Object* value);
1852  inline void SetInternalField(int index, Smi* value);
1853
1854  // The following lookup functions skip interceptors.
1855  void LocalLookupRealNamedProperty(String* name, LookupResult* result);
1856  void LookupRealNamedProperty(String* name, LookupResult* result);
1857  void LookupRealNamedPropertyInPrototypes(String* name, LookupResult* result);
1858  void LookupCallbackSetterInPrototypes(String* name, LookupResult* result);
1859  MUST_USE_RESULT MaybeObject* SetElementWithCallbackSetterInPrototypes(
1860      uint32_t index, Object* value, bool* found, StrictModeFlag strict_mode);
1861  void LookupCallback(String* name, LookupResult* result);
1862
1863  // Returns the number of properties on this object filtering out properties
1864  // with the specified attributes (ignoring interceptors).
1865  int NumberOfLocalProperties(PropertyAttributes filter = NONE);
1866  // Fill in details for properties into storage starting at the specified
1867  // index.
1868  void GetLocalPropertyNames(FixedArray* storage, int index);
1869
1870  // Returns the number of properties on this object filtering out properties
1871  // with the specified attributes (ignoring interceptors).
1872  int NumberOfLocalElements(PropertyAttributes filter);
1873  // Returns the number of enumerable elements (ignoring interceptors).
1874  int NumberOfEnumElements();
1875  // Returns the number of elements on this object filtering out elements
1876  // with the specified attributes (ignoring interceptors).
1877  int GetLocalElementKeys(FixedArray* storage, PropertyAttributes filter);
1878  // Count and fill in the enumerable elements into storage.
1879  // (storage->length() == NumberOfEnumElements()).
1880  // If storage is NULL, will count the elements without adding
1881  // them to any storage.
1882  // Returns the number of enumerable elements.
1883  int GetEnumElementKeys(FixedArray* storage);
1884
1885  // Add a property to a fast-case object using a map transition to
1886  // new_map.
1887  MUST_USE_RESULT MaybeObject* AddFastPropertyUsingMap(Map* new_map,
1888                                                       String* name,
1889                                                       Object* value);
1890
1891  // Add a constant function property to a fast-case object.
1892  // This leaves a CONSTANT_TRANSITION in the old map, and
1893  // if it is called on a second object with this map, a
1894  // normal property is added instead, with a map transition.
1895  // This avoids the creation of many maps with the same constant
1896  // function, all orphaned.
1897  MUST_USE_RESULT MaybeObject* AddConstantFunctionProperty(
1898      String* name,
1899      JSFunction* function,
1900      PropertyAttributes attributes);
1901
1902  MUST_USE_RESULT MaybeObject* ReplaceSlowProperty(
1903      String* name,
1904      Object* value,
1905      PropertyAttributes attributes);
1906
1907  // Returns a new map with all transitions dropped from the object's current
1908  // map and the ElementsKind set.
1909  static Handle<Map> GetElementsTransitionMap(Handle<JSObject> object,
1910                                              ElementsKind to_kind);
1911  inline MUST_USE_RESULT MaybeObject* GetElementsTransitionMap(
1912      Isolate* isolate,
1913      ElementsKind elements_kind);
1914  MUST_USE_RESULT MaybeObject* GetElementsTransitionMapSlow(
1915      ElementsKind elements_kind);
1916
1917  static Handle<Object> TransitionElementsKind(Handle<JSObject> object,
1918                                               ElementsKind to_kind);
1919
1920  MUST_USE_RESULT MaybeObject* TransitionElementsKind(ElementsKind to_kind);
1921
1922  // Converts a descriptor of any other type to a real field,
1923  // backed by the properties array.  Descriptors of visible
1924  // types, such as CONSTANT_FUNCTION, keep their enumeration order.
1925  // Converts the descriptor on the original object's map to a
1926  // map transition, and the the new field is on the object's new map.
1927  MUST_USE_RESULT MaybeObject* ConvertDescriptorToFieldAndMapTransition(
1928      String* name,
1929      Object* new_value,
1930      PropertyAttributes attributes);
1931
1932  // Converts a descriptor of any other type to a real field,
1933  // backed by the properties array.  Descriptors of visible
1934  // types, such as CONSTANT_FUNCTION, keep their enumeration order.
1935  MUST_USE_RESULT MaybeObject* ConvertDescriptorToField(
1936      String* name,
1937      Object* new_value,
1938      PropertyAttributes attributes);
1939
1940  // Add a property to a fast-case object.
1941  MUST_USE_RESULT MaybeObject* AddFastProperty(String* name,
1942                                               Object* value,
1943                                               PropertyAttributes attributes);
1944
1945  // Add a property to a slow-case object.
1946  MUST_USE_RESULT MaybeObject* AddSlowProperty(String* name,
1947                                               Object* value,
1948                                               PropertyAttributes attributes);
1949
1950  // Add a property to an object.
1951  MUST_USE_RESULT MaybeObject* AddProperty(String* name,
1952                                           Object* value,
1953                                           PropertyAttributes attributes,
1954                                           StrictModeFlag strict_mode);
1955
1956  // Convert the object to use the canonical dictionary
1957  // representation. If the object is expected to have additional properties
1958  // added this number can be indicated to have the backing store allocated to
1959  // an initial capacity for holding these properties.
1960  static void NormalizeProperties(Handle<JSObject> object,
1961                                  PropertyNormalizationMode mode,
1962                                  int expected_additional_properties);
1963
1964  MUST_USE_RESULT MaybeObject* NormalizeProperties(
1965      PropertyNormalizationMode mode,
1966      int expected_additional_properties);
1967
1968  // Convert and update the elements backing store to be a
1969  // SeededNumberDictionary dictionary.  Returns the backing after conversion.
1970  static Handle<SeededNumberDictionary> NormalizeElements(
1971      Handle<JSObject> object);
1972
1973  MUST_USE_RESULT MaybeObject* NormalizeElements();
1974
1975  static void UpdateMapCodeCache(Handle<JSObject> object,
1976                                 Handle<String> name,
1977                                 Handle<Code> code);
1978
1979  MUST_USE_RESULT MaybeObject* UpdateMapCodeCache(String* name, Code* code);
1980
1981  // Transform slow named properties to fast variants.
1982  // Returns failure if allocation failed.
1983  static void TransformToFastProperties(Handle<JSObject> object,
1984                                        int unused_property_fields);
1985
1986  MUST_USE_RESULT MaybeObject* TransformToFastProperties(
1987      int unused_property_fields);
1988
1989  // Access fast-case object properties at index.
1990  inline Object* FastPropertyAt(int index);
1991  inline Object* FastPropertyAtPut(int index, Object* value);
1992
1993  // Access to in object properties.
1994  inline int GetInObjectPropertyOffset(int index);
1995  inline Object* InObjectPropertyAt(int index);
1996  inline Object* InObjectPropertyAtPut(int index,
1997                                       Object* value,
1998                                       WriteBarrierMode mode
1999                                       = UPDATE_WRITE_BARRIER);
2000
2001  // Initializes the body after properties slot, properties slot is
2002  // initialized by set_properties.  Fill the pre-allocated fields with
2003  // pre_allocated_value and the rest with filler_value.
2004  // Note: this call does not update write barrier, the caller is responsible
2005  // to ensure that |filler_value| can be collected without WB here.
2006  inline void InitializeBody(Map* map,
2007                             Object* pre_allocated_value,
2008                             Object* filler_value);
2009
2010  // Check whether this object references another object
2011  bool ReferencesObject(Object* obj);
2012
2013  // Casting.
2014  static inline JSObject* cast(Object* obj);
2015
2016  // Disalow further properties to be added to the object.
2017  static Handle<Object> PreventExtensions(Handle<JSObject> object);
2018  MUST_USE_RESULT MaybeObject* PreventExtensions();
2019
2020
2021  // Dispatched behavior.
2022  void JSObjectShortPrint(StringStream* accumulator);
2023#ifdef OBJECT_PRINT
2024  inline void JSObjectPrint() {
2025    JSObjectPrint(stdout);
2026  }
2027  void JSObjectPrint(FILE* out);
2028#endif
2029#ifdef DEBUG
2030  void JSObjectVerify();
2031#endif
2032#ifdef OBJECT_PRINT
2033  inline void PrintProperties() {
2034    PrintProperties(stdout);
2035  }
2036  void PrintProperties(FILE* out);
2037
2038  inline void PrintElements() {
2039    PrintElements(stdout);
2040  }
2041  void PrintElements(FILE* out);
2042#endif
2043
2044  void PrintElementsTransition(
2045      FILE* file, ElementsKind from_kind, FixedArrayBase* from_elements,
2046      ElementsKind to_kind, FixedArrayBase* to_elements);
2047
2048#ifdef DEBUG
2049  // Structure for collecting spill information about JSObjects.
2050  class SpillInformation {
2051   public:
2052    void Clear();
2053    void Print();
2054    int number_of_objects_;
2055    int number_of_objects_with_fast_properties_;
2056    int number_of_objects_with_fast_elements_;
2057    int number_of_fast_used_fields_;
2058    int number_of_fast_unused_fields_;
2059    int number_of_slow_used_properties_;
2060    int number_of_slow_unused_properties_;
2061    int number_of_fast_used_elements_;
2062    int number_of_fast_unused_elements_;
2063    int number_of_slow_used_elements_;
2064    int number_of_slow_unused_elements_;
2065  };
2066
2067  void IncrementSpillStatistics(SpillInformation* info);
2068#endif
2069  Object* SlowReverseLookup(Object* value);
2070
2071  // Maximal number of fast properties for the JSObject. Used to
2072  // restrict the number of map transitions to avoid an explosion in
2073  // the number of maps for objects used as dictionaries.
2074  inline int MaxFastProperties();
2075
2076  // Maximal number of elements (numbered 0 .. kMaxElementCount - 1).
2077  // Also maximal value of JSArray's length property.
2078  static const uint32_t kMaxElementCount = 0xffffffffu;
2079
2080  // Constants for heuristics controlling conversion of fast elements
2081  // to slow elements.
2082
2083  // Maximal gap that can be introduced by adding an element beyond
2084  // the current elements length.
2085  static const uint32_t kMaxGap = 1024;
2086
2087  // Maximal length of fast elements array that won't be checked for
2088  // being dense enough on expansion.
2089  static const int kMaxUncheckedFastElementsLength = 5000;
2090
2091  // Same as above but for old arrays. This limit is more strict. We
2092  // don't want to be wasteful with long lived objects.
2093  static const int kMaxUncheckedOldFastElementsLength = 500;
2094
2095  static const int kInitialMaxFastElementArray = 100000;
2096  static const int kMaxFastProperties = 12;
2097  static const int kMaxInstanceSize = 255 * kPointerSize;
2098  // When extending the backing storage for property values, we increase
2099  // its size by more than the 1 entry necessary, so sequentially adding fields
2100  // to the same object requires fewer allocations and copies.
2101  static const int kFieldsAdded = 3;
2102
2103  // Layout description.
2104  static const int kPropertiesOffset = HeapObject::kHeaderSize;
2105  static const int kElementsOffset = kPropertiesOffset + kPointerSize;
2106  static const int kHeaderSize = kElementsOffset + kPointerSize;
2107
2108  STATIC_CHECK(kHeaderSize == Internals::kJSObjectHeaderSize);
2109
2110  class BodyDescriptor : public FlexibleBodyDescriptor<kPropertiesOffset> {
2111   public:
2112    static inline int SizeOf(Map* map, HeapObject* object);
2113  };
2114
2115 private:
2116  friend class DictionaryElementsAccessor;
2117
2118  MUST_USE_RESULT MaybeObject* GetElementWithCallback(Object* receiver,
2119                                                      Object* structure,
2120                                                      uint32_t index,
2121                                                      Object* holder);
2122  MUST_USE_RESULT MaybeObject* SetElementWithCallback(
2123      Object* structure,
2124      uint32_t index,
2125      Object* value,
2126      JSObject* holder,
2127      StrictModeFlag strict_mode);
2128  MUST_USE_RESULT MaybeObject* SetElementWithInterceptor(
2129      uint32_t index,
2130      Object* value,
2131      PropertyAttributes attributes,
2132      StrictModeFlag strict_mode,
2133      bool check_prototype,
2134      SetPropertyMode set_mode);
2135  MUST_USE_RESULT MaybeObject* SetElementWithoutInterceptor(
2136      uint32_t index,
2137      Object* value,
2138      PropertyAttributes attributes,
2139      StrictModeFlag strict_mode,
2140      bool check_prototype,
2141      SetPropertyMode set_mode);
2142
2143  // Searches the prototype chain for a callback setter and sets the property
2144  // with the setter if it finds one. The '*found' flag indicates whether
2145  // a setter was found or not.
2146  // This function can cause GC and can return a failure result with
2147  // '*found==true'.
2148  MUST_USE_RESULT MaybeObject* SetPropertyWithCallbackSetterInPrototypes(
2149      String* name,
2150      Object* value,
2151      PropertyAttributes attributes,
2152      bool* found,
2153      StrictModeFlag strict_mode);
2154
2155  MUST_USE_RESULT MaybeObject* DeletePropertyPostInterceptor(String* name,
2156                                                             DeleteMode mode);
2157  MUST_USE_RESULT MaybeObject* DeletePropertyWithInterceptor(String* name);
2158
2159  MUST_USE_RESULT MaybeObject* DeleteElementWithInterceptor(uint32_t index);
2160
2161  MUST_USE_RESULT MaybeObject* DeleteFastElement(uint32_t index);
2162  MUST_USE_RESULT MaybeObject* DeleteDictionaryElement(uint32_t index,
2163                                                       DeleteMode mode);
2164
2165  bool ReferencesObjectFromElements(FixedArray* elements,
2166                                    ElementsKind kind,
2167                                    Object* object);
2168
2169  // Returns true if most of the elements backing storage is used.
2170  bool HasDenseElements();
2171
2172  // Gets the current elements capacity and the number of used elements.
2173  void GetElementsCapacityAndUsage(int* capacity, int* used);
2174
2175  bool CanSetCallback(String* name);
2176  MUST_USE_RESULT MaybeObject* SetElementCallback(
2177      uint32_t index,
2178      Object* structure,
2179      PropertyAttributes attributes);
2180  MUST_USE_RESULT MaybeObject* SetPropertyCallback(
2181      String* name,
2182      Object* structure,
2183      PropertyAttributes attributes);
2184  MUST_USE_RESULT MaybeObject* DefineElementAccessor(
2185      uint32_t index,
2186      Object* getter,
2187      Object* setter,
2188      PropertyAttributes attributes);
2189  MUST_USE_RESULT MaybeObject* DefinePropertyAccessor(
2190      String* name,
2191      Object* getter,
2192      Object* setter,
2193      PropertyAttributes attributes);
2194  void LookupInDescriptor(String* name, LookupResult* result);
2195
2196  // Returns the hidden properties backing store object, currently
2197  // a StringDictionary, stored on this object.
2198  // If no hidden properties object has been put on this object,
2199  // return undefined, unless create_if_absent is true, in which case
2200  // a new dictionary is created, added to this object, and returned.
2201  MUST_USE_RESULT MaybeObject* GetHiddenPropertiesDictionary(
2202      bool create_if_absent);
2203  // Updates the existing hidden properties dictionary.
2204  MUST_USE_RESULT MaybeObject* SetHiddenPropertiesDictionary(
2205      StringDictionary* dictionary);
2206
2207  DISALLOW_IMPLICIT_CONSTRUCTORS(JSObject);
2208};
2209
2210
2211// Common superclass for FixedArrays that allow implementations to share
2212// common accessors and some code paths.
2213class FixedArrayBase: public HeapObject {
2214 public:
2215  // [length]: length of the array.
2216  inline int length();
2217  inline void set_length(int value);
2218
2219  inline static FixedArrayBase* cast(Object* object);
2220
2221  // Layout description.
2222  // Length is smi tagged when it is stored.
2223  static const int kLengthOffset = HeapObject::kHeaderSize;
2224  static const int kHeaderSize = kLengthOffset + kPointerSize;
2225};
2226
2227
2228class FixedDoubleArray;
2229
2230// FixedArray describes fixed-sized arrays with element type Object*.
2231class FixedArray: public FixedArrayBase {
2232 public:
2233  // Setter and getter for elements.
2234  inline Object* get(int index);
2235  // Setter that uses write barrier.
2236  inline void set(int index, Object* value);
2237  inline bool is_the_hole(int index);
2238
2239  // Setter that doesn't need write barrier).
2240  inline void set(int index, Smi* value);
2241  // Setter with explicit barrier mode.
2242  inline void set(int index, Object* value, WriteBarrierMode mode);
2243
2244  // Setters for frequently used oddballs located in old space.
2245  inline void set_undefined(int index);
2246  // TODO(isolates): duplicate.
2247  inline void set_undefined(Heap* heap, int index);
2248  inline void set_null(int index);
2249  // TODO(isolates): duplicate.
2250  inline void set_null(Heap* heap, int index);
2251  inline void set_the_hole(int index);
2252
2253  // Setters with less debug checks for the GC to use.
2254  inline void set_unchecked(int index, Smi* value);
2255  inline void set_null_unchecked(Heap* heap, int index);
2256  inline void set_unchecked(Heap* heap, int index, Object* value,
2257                            WriteBarrierMode mode);
2258
2259  // Gives access to raw memory which stores the array's data.
2260  inline Object** data_start();
2261
2262  inline Object** GetFirstElementAddress();
2263  inline bool ContainsOnlySmisOrHoles();
2264
2265  // Copy operations.
2266  MUST_USE_RESULT inline MaybeObject* Copy();
2267  MUST_USE_RESULT MaybeObject* CopySize(int new_length);
2268
2269  // Add the elements of a JSArray to this FixedArray.
2270  MUST_USE_RESULT MaybeObject* AddKeysFromJSArray(JSArray* array);
2271
2272  // Compute the union of this and other.
2273  MUST_USE_RESULT MaybeObject* UnionOfKeys(FixedArray* other);
2274
2275  // Copy a sub array from the receiver to dest.
2276  void CopyTo(int pos, FixedArray* dest, int dest_pos, int len);
2277
2278  // Garbage collection support.
2279  static int SizeFor(int length) { return kHeaderSize + length * kPointerSize; }
2280
2281  // Code Generation support.
2282  static int OffsetOfElementAt(int index) { return SizeFor(index); }
2283
2284  // Casting.
2285  static inline FixedArray* cast(Object* obj);
2286
2287  // Maximal allowed size, in bytes, of a single FixedArray.
2288  // Prevents overflowing size computations, as well as extreme memory
2289  // consumption.
2290  static const int kMaxSize = 128 * MB * kPointerSize;
2291  // Maximally allowed length of a FixedArray.
2292  static const int kMaxLength = (kMaxSize - kHeaderSize) / kPointerSize;
2293
2294  // Dispatched behavior.
2295#ifdef OBJECT_PRINT
2296  inline void FixedArrayPrint() {
2297    FixedArrayPrint(stdout);
2298  }
2299  void FixedArrayPrint(FILE* out);
2300#endif
2301#ifdef DEBUG
2302  void FixedArrayVerify();
2303  // Checks if two FixedArrays have identical contents.
2304  bool IsEqualTo(FixedArray* other);
2305#endif
2306
2307  // Swap two elements in a pair of arrays.  If this array and the
2308  // numbers array are the same object, the elements are only swapped
2309  // once.
2310  void SwapPairs(FixedArray* numbers, int i, int j);
2311
2312  // Sort prefix of this array and the numbers array as pairs wrt. the
2313  // numbers.  If the numbers array and the this array are the same
2314  // object, the prefix of this array is sorted.
2315  void SortPairs(FixedArray* numbers, uint32_t len);
2316
2317  class BodyDescriptor : public FlexibleBodyDescriptor<kHeaderSize> {
2318   public:
2319    static inline int SizeOf(Map* map, HeapObject* object) {
2320      return SizeFor(reinterpret_cast<FixedArray*>(object)->length());
2321    }
2322  };
2323
2324 protected:
2325  // Set operation on FixedArray without using write barriers. Can
2326  // only be used for storing old space objects or smis.
2327  static inline void NoWriteBarrierSet(FixedArray* array,
2328                                       int index,
2329                                       Object* value);
2330
2331  // Set operation on FixedArray without incremental write barrier. Can
2332  // only be used if the object is guaranteed to be white (whiteness witness
2333  // is present).
2334  static inline void NoIncrementalWriteBarrierSet(FixedArray* array,
2335                                                  int index,
2336                                                  Object* value);
2337
2338 private:
2339  DISALLOW_IMPLICIT_CONSTRUCTORS(FixedArray);
2340};
2341
2342
2343// FixedDoubleArray describes fixed-sized arrays with element type double.
2344class FixedDoubleArray: public FixedArrayBase {
2345 public:
2346  // Setter and getter for elements.
2347  inline double get_scalar(int index);
2348  inline int64_t get_representation(int index);
2349  MUST_USE_RESULT inline MaybeObject* get(int index);
2350  inline void set(int index, double value);
2351  inline void set_the_hole(int index);
2352
2353  // Checking for the hole.
2354  inline bool is_the_hole(int index);
2355
2356  // Copy operations
2357  MUST_USE_RESULT inline MaybeObject* Copy();
2358
2359  // Garbage collection support.
2360  inline static int SizeFor(int length) {
2361    return kHeaderSize + length * kDoubleSize;
2362  }
2363
2364  // Code Generation support.
2365  static int OffsetOfElementAt(int index) { return SizeFor(index); }
2366
2367  inline static bool is_the_hole_nan(double value);
2368  inline static double hole_nan_as_double();
2369  inline static double canonical_not_the_hole_nan_as_double();
2370
2371  // Casting.
2372  static inline FixedDoubleArray* cast(Object* obj);
2373
2374  // Maximal allowed size, in bytes, of a single FixedDoubleArray.
2375  // Prevents overflowing size computations, as well as extreme memory
2376  // consumption.
2377  static const int kMaxSize = 512 * MB;
2378  // Maximally allowed length of a FixedArray.
2379  static const int kMaxLength = (kMaxSize - kHeaderSize) / kDoubleSize;
2380
2381  // Dispatched behavior.
2382#ifdef OBJECT_PRINT
2383  inline void FixedDoubleArrayPrint() {
2384    FixedDoubleArrayPrint(stdout);
2385  }
2386  void FixedDoubleArrayPrint(FILE* out);
2387#endif
2388
2389#ifdef DEBUG
2390  void FixedDoubleArrayVerify();
2391#endif
2392
2393 private:
2394  DISALLOW_IMPLICIT_CONSTRUCTORS(FixedDoubleArray);
2395};
2396
2397
2398class IncrementalMarking;
2399
2400
2401// DescriptorArrays are fixed arrays used to hold instance descriptors.
2402// The format of the these objects is:
2403// TODO(1399): It should be possible to make room for bit_field3 in the map
2404//             without overloading the instance descriptors field in the map
2405//             (and storing it in the DescriptorArray when the map has one).
2406//   [0]: storage for bit_field3 for Map owning this object (Smi)
2407//   [1]: point to a fixed array with (value, detail) pairs.
2408//   [2]: next enumeration index (Smi), or pointer to small fixed array:
2409//          [0]: next enumeration index (Smi)
2410//          [1]: pointer to fixed array with enum cache
2411//   [3]: first key
2412//   [length() - 1]: last key
2413//
2414class DescriptorArray: public FixedArray {
2415 public:
2416  // Returns true for both shared empty_descriptor_array and for smis, which the
2417  // map uses to encode additional bit fields when the descriptor array is not
2418  // yet used.
2419  inline bool IsEmpty();
2420
2421  // Returns the number of descriptors in the array.
2422  int number_of_descriptors() {
2423    ASSERT(length() > kFirstIndex || IsEmpty());
2424    int len = length();
2425    return len <= kFirstIndex ? 0 : len - kFirstIndex;
2426  }
2427
2428  int NextEnumerationIndex() {
2429    if (IsEmpty()) return PropertyDetails::kInitialIndex;
2430    Object* obj = get(kEnumerationIndexIndex);
2431    if (obj->IsSmi()) {
2432      return Smi::cast(obj)->value();
2433    } else {
2434      Object* index = FixedArray::cast(obj)->get(kEnumCacheBridgeEnumIndex);
2435      return Smi::cast(index)->value();
2436    }
2437  }
2438
2439  // Set next enumeration index and flush any enum cache.
2440  void SetNextEnumerationIndex(int value) {
2441    if (!IsEmpty()) {
2442      set(kEnumerationIndexIndex, Smi::FromInt(value));
2443    }
2444  }
2445  bool HasEnumCache() {
2446    return !IsEmpty() && !get(kEnumerationIndexIndex)->IsSmi();
2447  }
2448
2449  Object* GetEnumCache() {
2450    ASSERT(HasEnumCache());
2451    FixedArray* bridge = FixedArray::cast(get(kEnumerationIndexIndex));
2452    return bridge->get(kEnumCacheBridgeCacheIndex);
2453  }
2454
2455  // TODO(1399): It should be possible to make room for bit_field3 in the map
2456  //             without overloading the instance descriptors field in the map
2457  //             (and storing it in the DescriptorArray when the map has one).
2458  inline int bit_field3_storage();
2459  inline void set_bit_field3_storage(int value);
2460
2461  // Initialize or change the enum cache,
2462  // using the supplied storage for the small "bridge".
2463  void SetEnumCache(FixedArray* bridge_storage,
2464                    FixedArray* new_cache,
2465                    Object* new_index_cache);
2466
2467  // Accessors for fetching instance descriptor at descriptor number.
2468  inline String* GetKey(int descriptor_number);
2469  inline Object* GetValue(int descriptor_number);
2470  inline Smi* GetDetails(int descriptor_number);
2471  inline PropertyType GetType(int descriptor_number);
2472  inline int GetFieldIndex(int descriptor_number);
2473  inline JSFunction* GetConstantFunction(int descriptor_number);
2474  inline Object* GetCallbacksObject(int descriptor_number);
2475  inline AccessorDescriptor* GetCallbacks(int descriptor_number);
2476  inline bool IsProperty(int descriptor_number);
2477  inline bool IsTransitionOnly(int descriptor_number);
2478  inline bool IsNullDescriptor(int descriptor_number);
2479  inline bool IsDontEnum(int descriptor_number);
2480
2481  class WhitenessWitness {
2482   public:
2483    inline explicit WhitenessWitness(DescriptorArray* array);
2484    inline ~WhitenessWitness();
2485
2486   private:
2487    IncrementalMarking* marking_;
2488  };
2489
2490  // Accessor for complete descriptor.
2491  inline void Get(int descriptor_number, Descriptor* desc);
2492  inline void Set(int descriptor_number,
2493                  Descriptor* desc,
2494                  const WhitenessWitness&);
2495
2496  // Transfer a complete descriptor from the src descriptor array to the dst
2497  // one, dropping map transitions in CALLBACKS.
2498  static void CopyFrom(Handle<DescriptorArray> dst,
2499                       int dst_index,
2500                       Handle<DescriptorArray> src,
2501                       int src_index,
2502                       const WhitenessWitness& witness);
2503
2504  // Transfer a complete descriptor from the src descriptor array to this
2505  // descriptor array, dropping map transitions in CALLBACKS.
2506  MUST_USE_RESULT MaybeObject* CopyFrom(int dst_index,
2507                                        DescriptorArray* src,
2508                                        int src_index,
2509                                        const WhitenessWitness&);
2510
2511  // Copy the descriptor array, insert a new descriptor and optionally
2512  // remove map transitions.  If the descriptor is already present, it is
2513  // replaced.  If a replaced descriptor is a real property (not a transition
2514  // or null), its enumeration index is kept as is.
2515  // If adding a real property, map transitions must be removed.  If adding
2516  // a transition, they must not be removed.  All null descriptors are removed.
2517  MUST_USE_RESULT MaybeObject* CopyInsert(Descriptor* descriptor,
2518                                          TransitionFlag transition_flag);
2519
2520  // Return a copy of the array with all transitions and null descriptors
2521  // removed. Return a Failure object in case of an allocation failure.
2522  MUST_USE_RESULT MaybeObject* RemoveTransitions();
2523
2524  // Sort the instance descriptors by the hash codes of their keys.
2525  // Does not check for duplicates.
2526  void SortUnchecked(const WhitenessWitness&);
2527
2528  // Sort the instance descriptors by the hash codes of their keys.
2529  // Checks the result for duplicates.
2530  void Sort(const WhitenessWitness&);
2531
2532  // Search the instance descriptors for given name.
2533  inline int Search(String* name);
2534
2535  // As the above, but uses DescriptorLookupCache and updates it when
2536  // necessary.
2537  inline int SearchWithCache(String* name);
2538
2539  // Tells whether the name is present int the array.
2540  bool Contains(String* name) { return kNotFound != Search(name); }
2541
2542  // Perform a binary search in the instance descriptors represented
2543  // by this fixed array.  low and high are descriptor indices.  If there
2544  // are three instance descriptors in this array it should be called
2545  // with low=0 and high=2.
2546  int BinarySearch(String* name, int low, int high);
2547
2548  // Perform a linear search in the instance descriptors represented
2549  // by this fixed array.  len is the number of descriptor indices that are
2550  // valid.  Does not require the descriptors to be sorted.
2551  int LinearSearch(String* name, int len);
2552
2553  // Allocates a DescriptorArray, but returns the singleton
2554  // empty descriptor array object if number_of_descriptors is 0.
2555  MUST_USE_RESULT static MaybeObject* Allocate(int number_of_descriptors);
2556
2557  // Casting.
2558  static inline DescriptorArray* cast(Object* obj);
2559
2560  // Constant for denoting key was not found.
2561  static const int kNotFound = -1;
2562
2563  static const int kBitField3StorageIndex = 0;
2564  static const int kContentArrayIndex = 1;
2565  static const int kEnumerationIndexIndex = 2;
2566  static const int kFirstIndex = 3;
2567
2568  // The length of the "bridge" to the enum cache.
2569  static const int kEnumCacheBridgeLength = 3;
2570  static const int kEnumCacheBridgeEnumIndex = 0;
2571  static const int kEnumCacheBridgeCacheIndex = 1;
2572  static const int kEnumCacheBridgeIndicesCacheIndex = 2;
2573
2574  // Layout description.
2575  static const int kBitField3StorageOffset = FixedArray::kHeaderSize;
2576  static const int kContentArrayOffset = kBitField3StorageOffset + kPointerSize;
2577  static const int kEnumerationIndexOffset = kContentArrayOffset + kPointerSize;
2578  static const int kFirstOffset = kEnumerationIndexOffset + kPointerSize;
2579
2580  // Layout description for the bridge array.
2581  static const int kEnumCacheBridgeEnumOffset = FixedArray::kHeaderSize;
2582  static const int kEnumCacheBridgeCacheOffset =
2583    kEnumCacheBridgeEnumOffset + kPointerSize;
2584
2585#ifdef OBJECT_PRINT
2586  // Print all the descriptors.
2587  inline void PrintDescriptors() {
2588    PrintDescriptors(stdout);
2589  }
2590  void PrintDescriptors(FILE* out);
2591#endif
2592
2593#ifdef DEBUG
2594  // Is the descriptor array sorted and without duplicates?
2595  bool IsSortedNoDuplicates();
2596
2597  // Are two DescriptorArrays equal?
2598  bool IsEqualTo(DescriptorArray* other);
2599#endif
2600
2601  // The maximum number of descriptors we want in a descriptor array (should
2602  // fit in a page).
2603  static const int kMaxNumberOfDescriptors = 1024 + 512;
2604
2605 private:
2606  // An entry in a DescriptorArray, represented as an (array, index) pair.
2607  class Entry {
2608   public:
2609    inline explicit Entry(DescriptorArray* descs, int index) :
2610        descs_(descs), index_(index) { }
2611
2612    inline PropertyType type() { return descs_->GetType(index_); }
2613    inline Object* GetCallbackObject() { return descs_->GetValue(index_); }
2614
2615   private:
2616    DescriptorArray* descs_;
2617    int index_;
2618  };
2619
2620  // Conversion from descriptor number to array indices.
2621  static int ToKeyIndex(int descriptor_number) {
2622    return descriptor_number+kFirstIndex;
2623  }
2624
2625  static int ToDetailsIndex(int descriptor_number) {
2626    return (descriptor_number << 1) + 1;
2627  }
2628
2629  static int ToValueIndex(int descriptor_number) {
2630    return descriptor_number << 1;
2631  }
2632
2633  bool is_null_descriptor(int descriptor_number) {
2634    return PropertyDetails(GetDetails(descriptor_number)).type() ==
2635        NULL_DESCRIPTOR;
2636  }
2637  // Swap operation on FixedArray without using write barriers.
2638  static inline void NoIncrementalWriteBarrierSwap(
2639      FixedArray* array, int first, int second);
2640
2641  // Swap descriptor first and second.
2642  inline void NoIncrementalWriteBarrierSwapDescriptors(
2643      int first, int second);
2644
2645  FixedArray* GetContentArray() {
2646    return FixedArray::cast(get(kContentArrayIndex));
2647  }
2648  DISALLOW_IMPLICIT_CONSTRUCTORS(DescriptorArray);
2649};
2650
2651
2652// HashTable is a subclass of FixedArray that implements a hash table
2653// that uses open addressing and quadratic probing.
2654//
2655// In order for the quadratic probing to work, elements that have not
2656// yet been used and elements that have been deleted are
2657// distinguished.  Probing continues when deleted elements are
2658// encountered and stops when unused elements are encountered.
2659//
2660// - Elements with key == undefined have not been used yet.
2661// - Elements with key == the_hole have been deleted.
2662//
2663// The hash table class is parameterized with a Shape and a Key.
2664// Shape must be a class with the following interface:
2665//   class ExampleShape {
2666//    public:
2667//      // Tells whether key matches other.
2668//     static bool IsMatch(Key key, Object* other);
2669//     // Returns the hash value for key.
2670//     static uint32_t Hash(Key key);
2671//     // Returns the hash value for object.
2672//     static uint32_t HashForObject(Key key, Object* object);
2673//     // Convert key to an object.
2674//     static inline Object* AsObject(Key key);
2675//     // The prefix size indicates number of elements in the beginning
2676//     // of the backing storage.
2677//     static const int kPrefixSize = ..;
2678//     // The Element size indicates number of elements per entry.
2679//     static const int kEntrySize = ..;
2680//   };
2681// The prefix size indicates an amount of memory in the
2682// beginning of the backing storage that can be used for non-element
2683// information by subclasses.
2684
2685template<typename Key>
2686class BaseShape {
2687 public:
2688  static const bool UsesSeed = false;
2689  static uint32_t Hash(Key key) { return 0; }
2690  static uint32_t SeededHash(Key key, uint32_t seed) {
2691    ASSERT(UsesSeed);
2692    return Hash(key);
2693  }
2694  static uint32_t HashForObject(Key key, Object* object) { return 0; }
2695  static uint32_t SeededHashForObject(Key key, uint32_t seed, Object* object) {
2696    ASSERT(UsesSeed);
2697    return HashForObject(key, object);
2698  }
2699};
2700
2701template<typename Shape, typename Key>
2702class HashTable: public FixedArray {
2703 public:
2704  // Wrapper methods
2705  inline uint32_t Hash(Key key) {
2706    if (Shape::UsesSeed) {
2707      return Shape::SeededHash(key,
2708          GetHeap()->HashSeed());
2709    } else {
2710      return Shape::Hash(key);
2711    }
2712  }
2713
2714  inline uint32_t HashForObject(Key key, Object* object) {
2715    if (Shape::UsesSeed) {
2716      return Shape::SeededHashForObject(key,
2717          GetHeap()->HashSeed(), object);
2718    } else {
2719      return Shape::HashForObject(key, object);
2720    }
2721  }
2722
2723  // Returns the number of elements in the hash table.
2724  int NumberOfElements() {
2725    return Smi::cast(get(kNumberOfElementsIndex))->value();
2726  }
2727
2728  // Returns the number of deleted elements in the hash table.
2729  int NumberOfDeletedElements() {
2730    return Smi::cast(get(kNumberOfDeletedElementsIndex))->value();
2731  }
2732
2733  // Returns the capacity of the hash table.
2734  int Capacity() {
2735    return Smi::cast(get(kCapacityIndex))->value();
2736  }
2737
2738  // ElementAdded should be called whenever an element is added to a
2739  // hash table.
2740  void ElementAdded() { SetNumberOfElements(NumberOfElements() + 1); }
2741
2742  // ElementRemoved should be called whenever an element is removed from
2743  // a hash table.
2744  void ElementRemoved() {
2745    SetNumberOfElements(NumberOfElements() - 1);
2746    SetNumberOfDeletedElements(NumberOfDeletedElements() + 1);
2747  }
2748  void ElementsRemoved(int n) {
2749    SetNumberOfElements(NumberOfElements() - n);
2750    SetNumberOfDeletedElements(NumberOfDeletedElements() + n);
2751  }
2752
2753  // Returns a new HashTable object. Might return Failure.
2754  MUST_USE_RESULT static MaybeObject* Allocate(
2755      int at_least_space_for,
2756      PretenureFlag pretenure = NOT_TENURED);
2757
2758  // Computes the required capacity for a table holding the given
2759  // number of elements. May be more than HashTable::kMaxCapacity.
2760  static int ComputeCapacity(int at_least_space_for);
2761
2762  // Returns the key at entry.
2763  Object* KeyAt(int entry) { return get(EntryToIndex(entry)); }
2764
2765  // Tells whether k is a real key.  The hole and undefined are not allowed
2766  // as keys and can be used to indicate missing or deleted elements.
2767  bool IsKey(Object* k) {
2768    return !k->IsTheHole() && !k->IsUndefined();
2769  }
2770
2771  // Garbage collection support.
2772  void IteratePrefix(ObjectVisitor* visitor);
2773  void IterateElements(ObjectVisitor* visitor);
2774
2775  // Casting.
2776  static inline HashTable* cast(Object* obj);
2777
2778  // Compute the probe offset (quadratic probing).
2779  INLINE(static uint32_t GetProbeOffset(uint32_t n)) {
2780    return (n + n * n) >> 1;
2781  }
2782
2783  static const int kNumberOfElementsIndex = 0;
2784  static const int kNumberOfDeletedElementsIndex = 1;
2785  static const int kCapacityIndex = 2;
2786  static const int kPrefixStartIndex = 3;
2787  static const int kElementsStartIndex =
2788      kPrefixStartIndex + Shape::kPrefixSize;
2789  static const int kEntrySize = Shape::kEntrySize;
2790  static const int kElementsStartOffset =
2791      kHeaderSize + kElementsStartIndex * kPointerSize;
2792  static const int kCapacityOffset =
2793      kHeaderSize + kCapacityIndex * kPointerSize;
2794
2795  // Constant used for denoting a absent entry.
2796  static const int kNotFound = -1;
2797
2798  // Maximal capacity of HashTable. Based on maximal length of underlying
2799  // FixedArray. Staying below kMaxCapacity also ensures that EntryToIndex
2800  // cannot overflow.
2801  static const int kMaxCapacity =
2802      (FixedArray::kMaxLength - kElementsStartOffset) / kEntrySize;
2803
2804  // Find entry for key otherwise return kNotFound.
2805  inline int FindEntry(Key key);
2806  int FindEntry(Isolate* isolate, Key key);
2807
2808 protected:
2809  // Find the entry at which to insert element with the given key that
2810  // has the given hash value.
2811  uint32_t FindInsertionEntry(uint32_t hash);
2812
2813  // Returns the index for an entry (of the key)
2814  static inline int EntryToIndex(int entry) {
2815    return (entry * kEntrySize) + kElementsStartIndex;
2816  }
2817
2818  // Update the number of elements in the hash table.
2819  void SetNumberOfElements(int nof) {
2820    set(kNumberOfElementsIndex, Smi::FromInt(nof));
2821  }
2822
2823  // Update the number of deleted elements in the hash table.
2824  void SetNumberOfDeletedElements(int nod) {
2825    set(kNumberOfDeletedElementsIndex, Smi::FromInt(nod));
2826  }
2827
2828  // Sets the capacity of the hash table.
2829  void SetCapacity(int capacity) {
2830    // To scale a computed hash code to fit within the hash table, we
2831    // use bit-wise AND with a mask, so the capacity must be positive
2832    // and non-zero.
2833    ASSERT(capacity > 0);
2834    ASSERT(capacity <= kMaxCapacity);
2835    set(kCapacityIndex, Smi::FromInt(capacity));
2836  }
2837
2838
2839  // Returns probe entry.
2840  static uint32_t GetProbe(uint32_t hash, uint32_t number, uint32_t size) {
2841    ASSERT(IsPowerOf2(size));
2842    return (hash + GetProbeOffset(number)) & (size - 1);
2843  }
2844
2845  static uint32_t FirstProbe(uint32_t hash, uint32_t size) {
2846    return hash & (size - 1);
2847  }
2848
2849  static uint32_t NextProbe(uint32_t last, uint32_t number, uint32_t size) {
2850    return (last + number) & (size - 1);
2851  }
2852
2853  // Rehashes this hash-table into the new table.
2854  MUST_USE_RESULT MaybeObject* Rehash(HashTable* new_table, Key key);
2855
2856  // Attempt to shrink hash table after removal of key.
2857  MUST_USE_RESULT MaybeObject* Shrink(Key key);
2858
2859  // Ensure enough space for n additional elements.
2860  MUST_USE_RESULT MaybeObject* EnsureCapacity(int n, Key key);
2861};
2862
2863
2864// HashTableKey is an abstract superclass for virtual key behavior.
2865class HashTableKey {
2866 public:
2867  // Returns whether the other object matches this key.
2868  virtual bool IsMatch(Object* other) = 0;
2869  // Returns the hash value for this key.
2870  virtual uint32_t Hash() = 0;
2871  // Returns the hash value for object.
2872  virtual uint32_t HashForObject(Object* key) = 0;
2873  // Returns the key object for storing into the hash table.
2874  // If allocations fails a failure object is returned.
2875  MUST_USE_RESULT virtual MaybeObject* AsObject() = 0;
2876  // Required.
2877  virtual ~HashTableKey() {}
2878};
2879
2880
2881class SymbolTableShape : public BaseShape<HashTableKey*> {
2882 public:
2883  static inline bool IsMatch(HashTableKey* key, Object* value) {
2884    return key->IsMatch(value);
2885  }
2886  static inline uint32_t Hash(HashTableKey* key) {
2887    return key->Hash();
2888  }
2889  static inline uint32_t HashForObject(HashTableKey* key, Object* object) {
2890    return key->HashForObject(object);
2891  }
2892  MUST_USE_RESULT static inline MaybeObject* AsObject(HashTableKey* key) {
2893    return key->AsObject();
2894  }
2895
2896  static const int kPrefixSize = 0;
2897  static const int kEntrySize = 1;
2898};
2899
2900class SeqAsciiString;
2901
2902// SymbolTable.
2903//
2904// No special elements in the prefix and the element size is 1
2905// because only the symbol itself (the key) needs to be stored.
2906class SymbolTable: public HashTable<SymbolTableShape, HashTableKey*> {
2907 public:
2908  // Find symbol in the symbol table.  If it is not there yet, it is
2909  // added.  The return value is the symbol table which might have
2910  // been enlarged.  If the return value is not a failure, the symbol
2911  // pointer *s is set to the symbol found.
2912  MUST_USE_RESULT MaybeObject* LookupSymbol(Vector<const char> str, Object** s);
2913  MUST_USE_RESULT MaybeObject* LookupAsciiSymbol(Vector<const char> str,
2914                                                 Object** s);
2915  MUST_USE_RESULT MaybeObject* LookupSubStringAsciiSymbol(
2916      Handle<SeqAsciiString> str,
2917      int from,
2918      int length,
2919      Object** s);
2920  MUST_USE_RESULT MaybeObject* LookupTwoByteSymbol(Vector<const uc16> str,
2921                                                   Object** s);
2922  MUST_USE_RESULT MaybeObject* LookupString(String* key, Object** s);
2923
2924  // Looks up a symbol that is equal to the given string and returns
2925  // true if it is found, assigning the symbol to the given output
2926  // parameter.
2927  bool LookupSymbolIfExists(String* str, String** symbol);
2928  bool LookupTwoCharsSymbolIfExists(uint32_t c1, uint32_t c2, String** symbol);
2929
2930  // Casting.
2931  static inline SymbolTable* cast(Object* obj);
2932
2933 private:
2934  MUST_USE_RESULT MaybeObject* LookupKey(HashTableKey* key, Object** s);
2935
2936  DISALLOW_IMPLICIT_CONSTRUCTORS(SymbolTable);
2937};
2938
2939
2940class MapCacheShape : public BaseShape<HashTableKey*> {
2941 public:
2942  static inline bool IsMatch(HashTableKey* key, Object* value) {
2943    return key->IsMatch(value);
2944  }
2945  static inline uint32_t Hash(HashTableKey* key) {
2946    return key->Hash();
2947  }
2948
2949  static inline uint32_t HashForObject(HashTableKey* key, Object* object) {
2950    return key->HashForObject(object);
2951  }
2952
2953  MUST_USE_RESULT static inline MaybeObject* AsObject(HashTableKey* key) {
2954    return key->AsObject();
2955  }
2956
2957  static const int kPrefixSize = 0;
2958  static const int kEntrySize = 2;
2959};
2960
2961
2962// MapCache.
2963//
2964// Maps keys that are a fixed array of symbols to a map.
2965// Used for canonicalize maps for object literals.
2966class MapCache: public HashTable<MapCacheShape, HashTableKey*> {
2967 public:
2968  // Find cached value for a string key, otherwise return null.
2969  Object* Lookup(FixedArray* key);
2970  MUST_USE_RESULT MaybeObject* Put(FixedArray* key, Map* value);
2971  static inline MapCache* cast(Object* obj);
2972
2973 private:
2974  DISALLOW_IMPLICIT_CONSTRUCTORS(MapCache);
2975};
2976
2977
2978template <typename Shape, typename Key>
2979class Dictionary: public HashTable<Shape, Key> {
2980 public:
2981  static inline Dictionary<Shape, Key>* cast(Object* obj) {
2982    return reinterpret_cast<Dictionary<Shape, Key>*>(obj);
2983  }
2984
2985  // Returns the value at entry.
2986  Object* ValueAt(int entry) {
2987    return this->get(HashTable<Shape, Key>::EntryToIndex(entry) + 1);
2988  }
2989
2990  // Set the value for entry.
2991  void ValueAtPut(int entry, Object* value) {
2992    this->set(HashTable<Shape, Key>::EntryToIndex(entry) + 1, value);
2993  }
2994
2995  // Returns the property details for the property at entry.
2996  PropertyDetails DetailsAt(int entry) {
2997    ASSERT(entry >= 0);  // Not found is -1, which is not caught by get().
2998    return PropertyDetails(
2999        Smi::cast(this->get(HashTable<Shape, Key>::EntryToIndex(entry) + 2)));
3000  }
3001
3002  // Set the details for entry.
3003  void DetailsAtPut(int entry, PropertyDetails value) {
3004    this->set(HashTable<Shape, Key>::EntryToIndex(entry) + 2, value.AsSmi());
3005  }
3006
3007  // Sorting support
3008  void CopyValuesTo(FixedArray* elements);
3009
3010  // Delete a property from the dictionary.
3011  Object* DeleteProperty(int entry, JSObject::DeleteMode mode);
3012
3013  // Attempt to shrink the dictionary after deletion of key.
3014  MUST_USE_RESULT MaybeObject* Shrink(Key key);
3015
3016  // Returns the number of elements in the dictionary filtering out properties
3017  // with the specified attributes.
3018  int NumberOfElementsFilterAttributes(PropertyAttributes filter);
3019
3020  // Returns the number of enumerable elements in the dictionary.
3021  int NumberOfEnumElements();
3022
3023  enum SortMode { UNSORTED, SORTED };
3024  // Copies keys to preallocated fixed array.
3025  void CopyKeysTo(FixedArray* storage,
3026                  PropertyAttributes filter,
3027                  SortMode sort_mode);
3028  // Fill in details for properties into storage.
3029  void CopyKeysTo(FixedArray* storage, int index, SortMode sort_mode);
3030
3031  // Accessors for next enumeration index.
3032  void SetNextEnumerationIndex(int index) {
3033    this->set(kNextEnumerationIndexIndex, Smi::FromInt(index));
3034  }
3035
3036  int NextEnumerationIndex() {
3037    return Smi::cast(FixedArray::get(kNextEnumerationIndexIndex))->value();
3038  }
3039
3040  // Returns a new array for dictionary usage. Might return Failure.
3041  MUST_USE_RESULT static MaybeObject* Allocate(int at_least_space_for);
3042
3043  // Ensure enough space for n additional elements.
3044  MUST_USE_RESULT MaybeObject* EnsureCapacity(int n, Key key);
3045
3046#ifdef OBJECT_PRINT
3047  inline void Print() {
3048    Print(stdout);
3049  }
3050  void Print(FILE* out);
3051#endif
3052  // Returns the key (slow).
3053  Object* SlowReverseLookup(Object* value);
3054
3055  // Sets the entry to (key, value) pair.
3056  inline void SetEntry(int entry,
3057                       Object* key,
3058                       Object* value);
3059  inline void SetEntry(int entry,
3060                       Object* key,
3061                       Object* value,
3062                       PropertyDetails details);
3063
3064  MUST_USE_RESULT MaybeObject* Add(Key key,
3065                                   Object* value,
3066                                   PropertyDetails details);
3067
3068 protected:
3069  // Generic at put operation.
3070  MUST_USE_RESULT MaybeObject* AtPut(Key key, Object* value);
3071
3072  // Add entry to dictionary.
3073  MUST_USE_RESULT MaybeObject* AddEntry(Key key,
3074                                        Object* value,
3075                                        PropertyDetails details,
3076                                        uint32_t hash);
3077
3078  // Generate new enumeration indices to avoid enumeration index overflow.
3079  MUST_USE_RESULT MaybeObject* GenerateNewEnumerationIndices();
3080  static const int kMaxNumberKeyIndex =
3081      HashTable<Shape, Key>::kPrefixStartIndex;
3082  static const int kNextEnumerationIndexIndex = kMaxNumberKeyIndex + 1;
3083};
3084
3085
3086class StringDictionaryShape : public BaseShape<String*> {
3087 public:
3088  static inline bool IsMatch(String* key, Object* other);
3089  static inline uint32_t Hash(String* key);
3090  static inline uint32_t HashForObject(String* key, Object* object);
3091  MUST_USE_RESULT static inline MaybeObject* AsObject(String* key);
3092  static const int kPrefixSize = 2;
3093  static const int kEntrySize = 3;
3094  static const bool kIsEnumerable = true;
3095};
3096
3097
3098class StringDictionary: public Dictionary<StringDictionaryShape, String*> {
3099 public:
3100  static inline StringDictionary* cast(Object* obj) {
3101    ASSERT(obj->IsDictionary());
3102    return reinterpret_cast<StringDictionary*>(obj);
3103  }
3104
3105  // Copies enumerable keys to preallocated fixed array.
3106  void CopyEnumKeysTo(FixedArray* storage, FixedArray* sort_array);
3107
3108  // For transforming properties of a JSObject.
3109  MUST_USE_RESULT MaybeObject* TransformPropertiesToFastFor(
3110      JSObject* obj,
3111      int unused_property_fields);
3112
3113  // Find entry for key, otherwise return kNotFound. Optimized version of
3114  // HashTable::FindEntry.
3115  int FindEntry(String* key);
3116
3117  bool ContainsTransition(int entry);
3118};
3119
3120
3121class NumberDictionaryShape : public BaseShape<uint32_t> {
3122 public:
3123  static inline bool IsMatch(uint32_t key, Object* other);
3124  MUST_USE_RESULT static inline MaybeObject* AsObject(uint32_t key);
3125  static const int kEntrySize = 3;
3126  static const bool kIsEnumerable = false;
3127};
3128
3129
3130class SeededNumberDictionaryShape : public NumberDictionaryShape {
3131 public:
3132  static const bool UsesSeed = true;
3133  static const int kPrefixSize = 2;
3134
3135  static inline uint32_t SeededHash(uint32_t key, uint32_t seed);
3136  static inline uint32_t SeededHashForObject(uint32_t key,
3137                                             uint32_t seed,
3138                                             Object* object);
3139};
3140
3141
3142class UnseededNumberDictionaryShape : public NumberDictionaryShape {
3143 public:
3144  static const int kPrefixSize = 0;
3145
3146  static inline uint32_t Hash(uint32_t key);
3147  static inline uint32_t HashForObject(uint32_t key, Object* object);
3148};
3149
3150
3151class SeededNumberDictionary
3152    : public Dictionary<SeededNumberDictionaryShape, uint32_t> {
3153 public:
3154  static SeededNumberDictionary* cast(Object* obj) {
3155    ASSERT(obj->IsDictionary());
3156    return reinterpret_cast<SeededNumberDictionary*>(obj);
3157  }
3158
3159  // Type specific at put (default NONE attributes is used when adding).
3160  MUST_USE_RESULT MaybeObject* AtNumberPut(uint32_t key, Object* value);
3161  MUST_USE_RESULT MaybeObject* AddNumberEntry(uint32_t key,
3162                                              Object* value,
3163                                              PropertyDetails details);
3164
3165  // Set an existing entry or add a new one if needed.
3166  // Return the updated dictionary.
3167  MUST_USE_RESULT static Handle<SeededNumberDictionary> Set(
3168      Handle<SeededNumberDictionary> dictionary,
3169      uint32_t index,
3170      Handle<Object> value,
3171      PropertyDetails details);
3172
3173  MUST_USE_RESULT MaybeObject* Set(uint32_t key,
3174                                   Object* value,
3175                                   PropertyDetails details);
3176
3177  void UpdateMaxNumberKey(uint32_t key);
3178
3179  // If slow elements are required we will never go back to fast-case
3180  // for the elements kept in this dictionary.  We require slow
3181  // elements if an element has been added at an index larger than
3182  // kRequiresSlowElementsLimit or set_requires_slow_elements() has been called
3183  // when defining a getter or setter with a number key.
3184  inline bool requires_slow_elements();
3185  inline void set_requires_slow_elements();
3186
3187  // Get the value of the max number key that has been added to this
3188  // dictionary.  max_number_key can only be called if
3189  // requires_slow_elements returns false.
3190  inline uint32_t max_number_key();
3191
3192  // Bit masks.
3193  static const int kRequiresSlowElementsMask = 1;
3194  static const int kRequiresSlowElementsTagSize = 1;
3195  static const uint32_t kRequiresSlowElementsLimit = (1 << 29) - 1;
3196};
3197
3198
3199class UnseededNumberDictionary
3200    : public Dictionary<UnseededNumberDictionaryShape, uint32_t> {
3201 public:
3202  static UnseededNumberDictionary* cast(Object* obj) {
3203    ASSERT(obj->IsDictionary());
3204    return reinterpret_cast<UnseededNumberDictionary*>(obj);
3205  }
3206
3207  // Type specific at put (default NONE attributes is used when adding).
3208  MUST_USE_RESULT MaybeObject* AtNumberPut(uint32_t key, Object* value);
3209  MUST_USE_RESULT MaybeObject* AddNumberEntry(uint32_t key, Object* value);
3210
3211  // Set an existing entry or add a new one if needed.
3212  // Return the updated dictionary.
3213  MUST_USE_RESULT static Handle<UnseededNumberDictionary> Set(
3214      Handle<UnseededNumberDictionary> dictionary,
3215      uint32_t index,
3216      Handle<Object> value);
3217
3218  MUST_USE_RESULT MaybeObject* Set(uint32_t key, Object* value);
3219};
3220
3221
3222template <int entrysize>
3223class ObjectHashTableShape : public BaseShape<Object*> {
3224 public:
3225  static inline bool IsMatch(Object* key, Object* other);
3226  static inline uint32_t Hash(Object* key);
3227  static inline uint32_t HashForObject(Object* key, Object* object);
3228  MUST_USE_RESULT static inline MaybeObject* AsObject(Object* key);
3229  static const int kPrefixSize = 0;
3230  static const int kEntrySize = entrysize;
3231};
3232
3233
3234// ObjectHashSet holds keys that are arbitrary objects by using the identity
3235// hash of the key for hashing purposes.
3236class ObjectHashSet: public HashTable<ObjectHashTableShape<1>, Object*> {
3237 public:
3238  static inline ObjectHashSet* cast(Object* obj) {
3239    ASSERT(obj->IsHashTable());
3240    return reinterpret_cast<ObjectHashSet*>(obj);
3241  }
3242
3243  // Looks up whether the given key is part of this hash set.
3244  bool Contains(Object* key);
3245
3246  // Adds the given key to this hash set.
3247  MUST_USE_RESULT MaybeObject* Add(Object* key);
3248
3249  // Removes the given key from this hash set.
3250  MUST_USE_RESULT MaybeObject* Remove(Object* key);
3251};
3252
3253
3254// ObjectHashTable maps keys that are arbitrary objects to object values by
3255// using the identity hash of the key for hashing purposes.
3256class ObjectHashTable: public HashTable<ObjectHashTableShape<2>, Object*> {
3257 public:
3258  static inline ObjectHashTable* cast(Object* obj) {
3259    ASSERT(obj->IsHashTable());
3260    return reinterpret_cast<ObjectHashTable*>(obj);
3261  }
3262
3263  // Looks up the value associated with the given key. The undefined value is
3264  // returned in case the key is not present.
3265  Object* Lookup(Object* key);
3266
3267  // Adds (or overwrites) the value associated with the given key. Mapping a
3268  // key to the undefined value causes removal of the whole entry.
3269  MUST_USE_RESULT MaybeObject* Put(Object* key, Object* value);
3270
3271 private:
3272  friend class MarkCompactCollector;
3273
3274  void AddEntry(int entry, Object* key, Object* value);
3275  void RemoveEntry(int entry);
3276
3277  // Returns the index to the value of an entry.
3278  static inline int EntryToValueIndex(int entry) {
3279    return EntryToIndex(entry) + 1;
3280  }
3281};
3282
3283
3284// JSFunctionResultCache caches results of some JSFunction invocation.
3285// It is a fixed array with fixed structure:
3286//   [0]: factory function
3287//   [1]: finger index
3288//   [2]: current cache size
3289//   [3]: dummy field.
3290// The rest of array are key/value pairs.
3291class JSFunctionResultCache: public FixedArray {
3292 public:
3293  static const int kFactoryIndex = 0;
3294  static const int kFingerIndex = kFactoryIndex + 1;
3295  static const int kCacheSizeIndex = kFingerIndex + 1;
3296  static const int kDummyIndex = kCacheSizeIndex + 1;
3297  static const int kEntriesIndex = kDummyIndex + 1;
3298
3299  static const int kEntrySize = 2;  // key + value
3300
3301  static const int kFactoryOffset = kHeaderSize;
3302  static const int kFingerOffset = kFactoryOffset + kPointerSize;
3303  static const int kCacheSizeOffset = kFingerOffset + kPointerSize;
3304
3305  inline void MakeZeroSize();
3306  inline void Clear();
3307
3308  inline int size();
3309  inline void set_size(int size);
3310  inline int finger_index();
3311  inline void set_finger_index(int finger_index);
3312
3313  // Casting
3314  static inline JSFunctionResultCache* cast(Object* obj);
3315
3316#ifdef DEBUG
3317  void JSFunctionResultCacheVerify();
3318#endif
3319};
3320
3321
3322// ScopeInfo represents information about different scopes of a source
3323// program  and the allocation of the scope's variables. Scope information
3324// is stored in a compressed form in ScopeInfo objects and is used
3325// at runtime (stack dumps, deoptimization, etc.).
3326
3327// This object provides quick access to scope info details for runtime
3328// routines.
3329class ScopeInfo : public FixedArray {
3330 public:
3331  static inline ScopeInfo* cast(Object* object);
3332
3333  // Return the type of this scope.
3334  ScopeType Type();
3335
3336  // Does this scope call eval?
3337  bool CallsEval();
3338
3339  // Return the language mode of this scope.
3340  LanguageMode language_mode();
3341
3342  // Does this scope make a non-strict eval call?
3343  bool CallsNonStrictEval() {
3344    return CallsEval() && (language_mode() == CLASSIC_MODE);
3345  }
3346
3347  // Return the total number of locals allocated on the stack and in the
3348  // context. This includes the parameters that are allocated in the context.
3349  int LocalCount();
3350
3351  // Return the number of stack slots for code. This number consists of two
3352  // parts:
3353  //  1. One stack slot per stack allocated local.
3354  //  2. One stack slot for the function name if it is stack allocated.
3355  int StackSlotCount();
3356
3357  // Return the number of context slots for code if a context is allocated. This
3358  // number consists of three parts:
3359  //  1. Size of fixed header for every context: Context::MIN_CONTEXT_SLOTS
3360  //  2. One context slot per context allocated local.
3361  //  3. One context slot for the function name if it is context allocated.
3362  // Parameters allocated in the context count as context allocated locals. If
3363  // no contexts are allocated for this scope ContextLength returns 0.
3364  int ContextLength();
3365
3366  // Is this scope the scope of a named function expression?
3367  bool HasFunctionName();
3368
3369  // Return if this has context allocated locals.
3370  bool HasHeapAllocatedLocals();
3371
3372  // Return if contexts are allocated for this scope.
3373  bool HasContext();
3374
3375  // Return the function_name if present.
3376  String* FunctionName();
3377
3378  // Return the name of the given parameter.
3379  String* ParameterName(int var);
3380
3381  // Return the name of the given local.
3382  String* LocalName(int var);
3383
3384  // Return the name of the given stack local.
3385  String* StackLocalName(int var);
3386
3387  // Return the name of the given context local.
3388  String* ContextLocalName(int var);
3389
3390  // Return the mode of the given context local.
3391  VariableMode ContextLocalMode(int var);
3392
3393  // Return the initialization flag of the given context local.
3394  InitializationFlag ContextLocalInitFlag(int var);
3395
3396  // Lookup support for serialized scope info. Returns the
3397  // the stack slot index for a given slot name if the slot is
3398  // present; otherwise returns a value < 0. The name must be a symbol
3399  // (canonicalized).
3400  int StackSlotIndex(String* name);
3401
3402  // Lookup support for serialized scope info. Returns the
3403  // context slot index for a given slot name if the slot is present; otherwise
3404  // returns a value < 0. The name must be a symbol (canonicalized).
3405  // If the slot is present and mode != NULL, sets *mode to the corresponding
3406  // mode for that variable.
3407  int ContextSlotIndex(String* name,
3408                       VariableMode* mode,
3409                       InitializationFlag* init_flag);
3410
3411  // Lookup support for serialized scope info. Returns the
3412  // parameter index for a given parameter name if the parameter is present;
3413  // otherwise returns a value < 0. The name must be a symbol (canonicalized).
3414  int ParameterIndex(String* name);
3415
3416  // Lookup support for serialized scope info. Returns the
3417  // function context slot index if the function name is present (named
3418  // function expressions, only), otherwise returns a value < 0. The name
3419  // must be a symbol (canonicalized).
3420  int FunctionContextSlotIndex(String* name, VariableMode* mode);
3421
3422  static Handle<ScopeInfo> Create(Scope* scope);
3423
3424  // Serializes empty scope info.
3425  static ScopeInfo* Empty();
3426
3427#ifdef DEBUG
3428  void Print();
3429#endif
3430
3431  // The layout of the static part of a ScopeInfo is as follows. Each entry is
3432  // numeric and occupies one array slot.
3433  // 1. A set of properties of the scope
3434  // 2. The number of parameters. This only applies to function scopes. For
3435  //    non-function scopes this is 0.
3436  // 3. The number of non-parameter variables allocated on the stack.
3437  // 4. The number of non-parameter and parameter variables allocated in the
3438  //    context.
3439#define FOR_EACH_NUMERIC_FIELD(V)          \
3440  V(Flags)                                 \
3441  V(ParameterCount)                        \
3442  V(StackLocalCount)                       \
3443  V(ContextLocalCount)
3444
3445#define FIELD_ACCESSORS(name)                            \
3446  void Set##name(int value) {                            \
3447    set(k##name, Smi::FromInt(value));                   \
3448  }                                                      \
3449  int name() {                                           \
3450    if (length() > 0) {                                  \
3451      return Smi::cast(get(k##name))->value();           \
3452    } else {                                             \
3453      return 0;                                          \
3454    }                                                    \
3455  }
3456  FOR_EACH_NUMERIC_FIELD(FIELD_ACCESSORS)
3457#undef FIELD_ACCESSORS
3458
3459 private:
3460  enum {
3461#define DECL_INDEX(name) k##name,
3462  FOR_EACH_NUMERIC_FIELD(DECL_INDEX)
3463#undef DECL_INDEX
3464#undef FOR_EACH_NUMERIC_FIELD
3465  kVariablePartIndex
3466  };
3467
3468  // The layout of the variable part of a ScopeInfo is as follows:
3469  // 1. ParameterEntries:
3470  //    This part stores the names of the parameters for function scopes. One
3471  //    slot is used per parameter, so in total this part occupies
3472  //    ParameterCount() slots in the array. For other scopes than function
3473  //    scopes ParameterCount() is 0.
3474  // 2. StackLocalEntries:
3475  //    Contains the names of local variables that are allocated on the stack,
3476  //    in increasing order of the stack slot index. One slot is used per stack
3477  //    local, so in total this part occupies StackLocalCount() slots in the
3478  //    array.
3479  // 3. ContextLocalNameEntries:
3480  //    Contains the names of local variables and parameters that are allocated
3481  //    in the context. They are stored in increasing order of the context slot
3482  //    index starting with Context::MIN_CONTEXT_SLOTS. One slot is used per
3483  //    context local, so in total this part occupies ContextLocalCount() slots
3484  //    in the array.
3485  // 4. ContextLocalInfoEntries:
3486  //    Contains the variable modes and initialization flags corresponding to
3487  //    the context locals in ContextLocalNameEntries. One slot is used per
3488  //    context local, so in total this part occupies ContextLocalCount()
3489  //    slots in the array.
3490  // 5. FunctionNameEntryIndex:
3491  //    If the scope belongs to a named function expression this part contains
3492  //    information about the function variable. It always occupies two array
3493  //    slots:  a. The name of the function variable.
3494  //            b. The context or stack slot index for the variable.
3495  int ParameterEntriesIndex();
3496  int StackLocalEntriesIndex();
3497  int ContextLocalNameEntriesIndex();
3498  int ContextLocalInfoEntriesIndex();
3499  int FunctionNameEntryIndex();
3500
3501  // Location of the function variable for named function expressions.
3502  enum FunctionVariableInfo {
3503    NONE,     // No function name present.
3504    STACK,    // Function
3505    CONTEXT,
3506    UNUSED
3507  };
3508
3509  // Properties of scopes.
3510  class TypeField:             public BitField<ScopeType,            0, 3> {};
3511  class CallsEvalField:        public BitField<bool,                 3, 1> {};
3512  class LanguageModeField:     public BitField<LanguageMode,         4, 2> {};
3513  class FunctionVariableField: public BitField<FunctionVariableInfo, 6, 2> {};
3514  class FunctionVariableMode:  public BitField<VariableMode,         8, 3> {};
3515
3516  // BitFields representing the encoded information for context locals in the
3517  // ContextLocalInfoEntries part.
3518  class ContextLocalMode:      public BitField<VariableMode,         0, 3> {};
3519  class ContextLocalInitFlag:  public BitField<InitializationFlag,   3, 1> {};
3520};
3521
3522
3523// The cache for maps used by normalized (dictionary mode) objects.
3524// Such maps do not have property descriptors, so a typical program
3525// needs very limited number of distinct normalized maps.
3526class NormalizedMapCache: public FixedArray {
3527 public:
3528  static const int kEntries = 64;
3529
3530  MUST_USE_RESULT MaybeObject* Get(JSObject* object,
3531                                   PropertyNormalizationMode mode);
3532
3533  void Clear();
3534
3535  // Casting
3536  static inline NormalizedMapCache* cast(Object* obj);
3537
3538#ifdef DEBUG
3539  void NormalizedMapCacheVerify();
3540#endif
3541};
3542
3543
3544// ByteArray represents fixed sized byte arrays.  Used for the relocation info
3545// that is attached to code objects.
3546class ByteArray: public FixedArrayBase {
3547 public:
3548  inline int Size() { return RoundUp(length() + kHeaderSize, kPointerSize); }
3549
3550  // Setter and getter.
3551  inline byte get(int index);
3552  inline void set(int index, byte value);
3553
3554  // Treat contents as an int array.
3555  inline int get_int(int index);
3556
3557  static int SizeFor(int length) {
3558    return OBJECT_POINTER_ALIGN(kHeaderSize + length);
3559  }
3560  // We use byte arrays for free blocks in the heap.  Given a desired size in
3561  // bytes that is a multiple of the word size and big enough to hold a byte
3562  // array, this function returns the number of elements a byte array should
3563  // have.
3564  static int LengthFor(int size_in_bytes) {
3565    ASSERT(IsAligned(size_in_bytes, kPointerSize));
3566    ASSERT(size_in_bytes >= kHeaderSize);
3567    return size_in_bytes - kHeaderSize;
3568  }
3569
3570  // Returns data start address.
3571  inline Address GetDataStartAddress();
3572
3573  // Returns a pointer to the ByteArray object for a given data start address.
3574  static inline ByteArray* FromDataStartAddress(Address address);
3575
3576  // Casting.
3577  static inline ByteArray* cast(Object* obj);
3578
3579  // Dispatched behavior.
3580  inline int ByteArraySize() {
3581    return SizeFor(this->length());
3582  }
3583#ifdef OBJECT_PRINT
3584  inline void ByteArrayPrint() {
3585    ByteArrayPrint(stdout);
3586  }
3587  void ByteArrayPrint(FILE* out);
3588#endif
3589#ifdef DEBUG
3590  void ByteArrayVerify();
3591#endif
3592
3593  // Layout description.
3594  static const int kAlignedSize = OBJECT_POINTER_ALIGN(kHeaderSize);
3595
3596  // Maximal memory consumption for a single ByteArray.
3597  static const int kMaxSize = 512 * MB;
3598  // Maximal length of a single ByteArray.
3599  static const int kMaxLength = kMaxSize - kHeaderSize;
3600
3601 private:
3602  DISALLOW_IMPLICIT_CONSTRUCTORS(ByteArray);
3603};
3604
3605
3606// FreeSpace represents fixed sized areas of the heap that are not currently in
3607// use.  Used by the heap and GC.
3608class FreeSpace: public HeapObject {
3609 public:
3610  // [size]: size of the free space including the header.
3611  inline int size();
3612  inline void set_size(int value);
3613
3614  inline int Size() { return size(); }
3615
3616  // Casting.
3617  static inline FreeSpace* cast(Object* obj);
3618
3619#ifdef OBJECT_PRINT
3620  inline void FreeSpacePrint() {
3621    FreeSpacePrint(stdout);
3622  }
3623  void FreeSpacePrint(FILE* out);
3624#endif
3625#ifdef DEBUG
3626  void FreeSpaceVerify();
3627#endif
3628
3629  // Layout description.
3630  // Size is smi tagged when it is stored.
3631  static const int kSizeOffset = HeapObject::kHeaderSize;
3632  static const int kHeaderSize = kSizeOffset + kPointerSize;
3633
3634  static const int kAlignedSize = OBJECT_POINTER_ALIGN(kHeaderSize);
3635
3636 private:
3637  DISALLOW_IMPLICIT_CONSTRUCTORS(FreeSpace);
3638};
3639
3640
3641// An ExternalArray represents a fixed-size array of primitive values
3642// which live outside the JavaScript heap. Its subclasses are used to
3643// implement the CanvasArray types being defined in the WebGL
3644// specification. As of this writing the first public draft is not yet
3645// available, but Khronos members can access the draft at:
3646//   https://cvs.khronos.org/svn/repos/3dweb/trunk/doc/spec/WebGL-spec.html
3647//
3648// The semantics of these arrays differ from CanvasPixelArray.
3649// Out-of-range values passed to the setter are converted via a C
3650// cast, not clamping. Out-of-range indices cause exceptions to be
3651// raised rather than being silently ignored.
3652class ExternalArray: public FixedArrayBase {
3653 public:
3654  inline bool is_the_hole(int index) { return false; }
3655
3656  // [external_pointer]: The pointer to the external memory area backing this
3657  // external array.
3658  DECL_ACCESSORS(external_pointer, void)  // Pointer to the data store.
3659
3660  // Casting.
3661  static inline ExternalArray* cast(Object* obj);
3662
3663  // Maximal acceptable length for an external array.
3664  static const int kMaxLength = 0x3fffffff;
3665
3666  // ExternalArray headers are not quadword aligned.
3667  static const int kExternalPointerOffset =
3668      POINTER_SIZE_ALIGN(FixedArrayBase::kLengthOffset + kPointerSize);
3669  static const int kHeaderSize = kExternalPointerOffset + kPointerSize;
3670  static const int kAlignedSize = OBJECT_POINTER_ALIGN(kHeaderSize);
3671
3672 private:
3673  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalArray);
3674};
3675
3676
3677// A ExternalPixelArray represents a fixed-size byte array with special
3678// semantics used for implementing the CanvasPixelArray object. Please see the
3679// specification at:
3680
3681// http://www.whatwg.org/specs/web-apps/current-work/
3682//                      multipage/the-canvas-element.html#canvaspixelarray
3683// In particular, write access clamps the value written to 0 or 255 if the
3684// value written is outside this range.
3685class ExternalPixelArray: public ExternalArray {
3686 public:
3687  inline uint8_t* external_pixel_pointer();
3688
3689  // Setter and getter.
3690  inline uint8_t get_scalar(int index);
3691  MUST_USE_RESULT inline MaybeObject* get(int index);
3692  inline void set(int index, uint8_t value);
3693
3694  // This accessor applies the correct conversion from Smi, HeapNumber and
3695  // undefined and clamps the converted value between 0 and 255.
3696  Object* SetValue(uint32_t index, Object* value);
3697
3698  // Casting.
3699  static inline ExternalPixelArray* cast(Object* obj);
3700
3701#ifdef OBJECT_PRINT
3702  inline void ExternalPixelArrayPrint() {
3703    ExternalPixelArrayPrint(stdout);
3704  }
3705  void ExternalPixelArrayPrint(FILE* out);
3706#endif
3707#ifdef DEBUG
3708  void ExternalPixelArrayVerify();
3709#endif  // DEBUG
3710
3711 private:
3712  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalPixelArray);
3713};
3714
3715
3716class ExternalByteArray: public ExternalArray {
3717 public:
3718  // Setter and getter.
3719  inline int8_t get_scalar(int index);
3720  MUST_USE_RESULT inline MaybeObject* get(int index);
3721  inline void set(int index, int8_t value);
3722
3723  // This accessor applies the correct conversion from Smi, HeapNumber
3724  // and undefined.
3725  MUST_USE_RESULT MaybeObject* SetValue(uint32_t index, Object* value);
3726
3727  // Casting.
3728  static inline ExternalByteArray* cast(Object* obj);
3729
3730#ifdef OBJECT_PRINT
3731  inline void ExternalByteArrayPrint() {
3732    ExternalByteArrayPrint(stdout);
3733  }
3734  void ExternalByteArrayPrint(FILE* out);
3735#endif
3736#ifdef DEBUG
3737  void ExternalByteArrayVerify();
3738#endif  // DEBUG
3739
3740 private:
3741  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalByteArray);
3742};
3743
3744
3745class ExternalUnsignedByteArray: public ExternalArray {
3746 public:
3747  // Setter and getter.
3748  inline uint8_t get_scalar(int index);
3749  MUST_USE_RESULT inline MaybeObject* get(int index);
3750  inline void set(int index, uint8_t value);
3751
3752  // This accessor applies the correct conversion from Smi, HeapNumber
3753  // and undefined.
3754  MUST_USE_RESULT MaybeObject* SetValue(uint32_t index, Object* value);
3755
3756  // Casting.
3757  static inline ExternalUnsignedByteArray* cast(Object* obj);
3758
3759#ifdef OBJECT_PRINT
3760  inline void ExternalUnsignedByteArrayPrint() {
3761    ExternalUnsignedByteArrayPrint(stdout);
3762  }
3763  void ExternalUnsignedByteArrayPrint(FILE* out);
3764#endif
3765#ifdef DEBUG
3766  void ExternalUnsignedByteArrayVerify();
3767#endif  // DEBUG
3768
3769 private:
3770  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalUnsignedByteArray);
3771};
3772
3773
3774class ExternalShortArray: public ExternalArray {
3775 public:
3776  // Setter and getter.
3777  inline int16_t get_scalar(int index);
3778  MUST_USE_RESULT inline MaybeObject* get(int index);
3779  inline void set(int index, int16_t value);
3780
3781  // This accessor applies the correct conversion from Smi, HeapNumber
3782  // and undefined.
3783  MUST_USE_RESULT MaybeObject* SetValue(uint32_t index, Object* value);
3784
3785  // Casting.
3786  static inline ExternalShortArray* cast(Object* obj);
3787
3788#ifdef OBJECT_PRINT
3789  inline void ExternalShortArrayPrint() {
3790    ExternalShortArrayPrint(stdout);
3791  }
3792  void ExternalShortArrayPrint(FILE* out);
3793#endif
3794#ifdef DEBUG
3795  void ExternalShortArrayVerify();
3796#endif  // DEBUG
3797
3798 private:
3799  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalShortArray);
3800};
3801
3802
3803class ExternalUnsignedShortArray: public ExternalArray {
3804 public:
3805  // Setter and getter.
3806  inline uint16_t get_scalar(int index);
3807  MUST_USE_RESULT inline MaybeObject* get(int index);
3808  inline void set(int index, uint16_t value);
3809
3810  // This accessor applies the correct conversion from Smi, HeapNumber
3811  // and undefined.
3812  MUST_USE_RESULT MaybeObject* SetValue(uint32_t index, Object* value);
3813
3814  // Casting.
3815  static inline ExternalUnsignedShortArray* cast(Object* obj);
3816
3817#ifdef OBJECT_PRINT
3818  inline void ExternalUnsignedShortArrayPrint() {
3819    ExternalUnsignedShortArrayPrint(stdout);
3820  }
3821  void ExternalUnsignedShortArrayPrint(FILE* out);
3822#endif
3823#ifdef DEBUG
3824  void ExternalUnsignedShortArrayVerify();
3825#endif  // DEBUG
3826
3827 private:
3828  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalUnsignedShortArray);
3829};
3830
3831
3832class ExternalIntArray: public ExternalArray {
3833 public:
3834  // Setter and getter.
3835  inline int32_t get_scalar(int index);
3836  MUST_USE_RESULT inline MaybeObject* get(int index);
3837  inline void set(int index, int32_t value);
3838
3839  // This accessor applies the correct conversion from Smi, HeapNumber
3840  // and undefined.
3841  MUST_USE_RESULT MaybeObject* SetValue(uint32_t index, Object* value);
3842
3843  // Casting.
3844  static inline ExternalIntArray* cast(Object* obj);
3845
3846#ifdef OBJECT_PRINT
3847  inline void ExternalIntArrayPrint() {
3848    ExternalIntArrayPrint(stdout);
3849  }
3850  void ExternalIntArrayPrint(FILE* out);
3851#endif
3852#ifdef DEBUG
3853  void ExternalIntArrayVerify();
3854#endif  // DEBUG
3855
3856 private:
3857  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalIntArray);
3858};
3859
3860
3861class ExternalUnsignedIntArray: public ExternalArray {
3862 public:
3863  // Setter and getter.
3864  inline uint32_t get_scalar(int index);
3865  MUST_USE_RESULT inline MaybeObject* get(int index);
3866  inline void set(int index, uint32_t value);
3867
3868  // This accessor applies the correct conversion from Smi, HeapNumber
3869  // and undefined.
3870  MUST_USE_RESULT MaybeObject* SetValue(uint32_t index, Object* value);
3871
3872  // Casting.
3873  static inline ExternalUnsignedIntArray* cast(Object* obj);
3874
3875#ifdef OBJECT_PRINT
3876  inline void ExternalUnsignedIntArrayPrint() {
3877    ExternalUnsignedIntArrayPrint(stdout);
3878  }
3879  void ExternalUnsignedIntArrayPrint(FILE* out);
3880#endif
3881#ifdef DEBUG
3882  void ExternalUnsignedIntArrayVerify();
3883#endif  // DEBUG
3884
3885 private:
3886  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalUnsignedIntArray);
3887};
3888
3889
3890class ExternalFloatArray: public ExternalArray {
3891 public:
3892  // Setter and getter.
3893  inline float get_scalar(int index);
3894  MUST_USE_RESULT inline MaybeObject* get(int index);
3895  inline void set(int index, float value);
3896
3897  // This accessor applies the correct conversion from Smi, HeapNumber
3898  // and undefined.
3899  MUST_USE_RESULT MaybeObject* SetValue(uint32_t index, Object* value);
3900
3901  // Casting.
3902  static inline ExternalFloatArray* cast(Object* obj);
3903
3904#ifdef OBJECT_PRINT
3905  inline void ExternalFloatArrayPrint() {
3906    ExternalFloatArrayPrint(stdout);
3907  }
3908  void ExternalFloatArrayPrint(FILE* out);
3909#endif
3910#ifdef DEBUG
3911  void ExternalFloatArrayVerify();
3912#endif  // DEBUG
3913
3914 private:
3915  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalFloatArray);
3916};
3917
3918
3919class ExternalDoubleArray: public ExternalArray {
3920 public:
3921  // Setter and getter.
3922  inline double get_scalar(int index);
3923  MUST_USE_RESULT inline MaybeObject* get(int index);
3924  inline void set(int index, double value);
3925
3926  // This accessor applies the correct conversion from Smi, HeapNumber
3927  // and undefined.
3928  MUST_USE_RESULT MaybeObject* SetValue(uint32_t index, Object* value);
3929
3930  // Casting.
3931  static inline ExternalDoubleArray* cast(Object* obj);
3932
3933#ifdef OBJECT_PRINT
3934  inline void ExternalDoubleArrayPrint() {
3935    ExternalDoubleArrayPrint(stdout);
3936  }
3937  void ExternalDoubleArrayPrint(FILE* out);
3938#endif  // OBJECT_PRINT
3939#ifdef DEBUG
3940  void ExternalDoubleArrayVerify();
3941#endif  // DEBUG
3942
3943 private:
3944  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalDoubleArray);
3945};
3946
3947
3948// DeoptimizationInputData is a fixed array used to hold the deoptimization
3949// data for code generated by the Hydrogen/Lithium compiler.  It also
3950// contains information about functions that were inlined.  If N different
3951// functions were inlined then first N elements of the literal array will
3952// contain these functions.
3953//
3954// It can be empty.
3955class DeoptimizationInputData: public FixedArray {
3956 public:
3957  // Layout description.  Indices in the array.
3958  static const int kTranslationByteArrayIndex = 0;
3959  static const int kInlinedFunctionCountIndex = 1;
3960  static const int kLiteralArrayIndex = 2;
3961  static const int kOsrAstIdIndex = 3;
3962  static const int kOsrPcOffsetIndex = 4;
3963  static const int kFirstDeoptEntryIndex = 5;
3964
3965  // Offsets of deopt entry elements relative to the start of the entry.
3966  static const int kAstIdOffset = 0;
3967  static const int kTranslationIndexOffset = 1;
3968  static const int kArgumentsStackHeightOffset = 2;
3969  static const int kPcOffset = 3;
3970  static const int kDeoptEntrySize = 4;
3971
3972  // Simple element accessors.
3973#define DEFINE_ELEMENT_ACCESSORS(name, type)      \
3974  type* name() {                                  \
3975    return type::cast(get(k##name##Index));       \
3976  }                                               \
3977  void Set##name(type* value) {                   \
3978    set(k##name##Index, value);                   \
3979  }
3980
3981  DEFINE_ELEMENT_ACCESSORS(TranslationByteArray, ByteArray)
3982  DEFINE_ELEMENT_ACCESSORS(InlinedFunctionCount, Smi)
3983  DEFINE_ELEMENT_ACCESSORS(LiteralArray, FixedArray)
3984  DEFINE_ELEMENT_ACCESSORS(OsrAstId, Smi)
3985  DEFINE_ELEMENT_ACCESSORS(OsrPcOffset, Smi)
3986
3987#undef DEFINE_ELEMENT_ACCESSORS
3988
3989  // Accessors for elements of the ith deoptimization entry.
3990#define DEFINE_ENTRY_ACCESSORS(name, type)                       \
3991  type* name(int i) {                                            \
3992    return type::cast(get(IndexForEntry(i) + k##name##Offset));  \
3993  }                                                              \
3994  void Set##name(int i, type* value) {                           \
3995    set(IndexForEntry(i) + k##name##Offset, value);              \
3996  }
3997
3998  DEFINE_ENTRY_ACCESSORS(AstId, Smi)
3999  DEFINE_ENTRY_ACCESSORS(TranslationIndex, Smi)
4000  DEFINE_ENTRY_ACCESSORS(ArgumentsStackHeight, Smi)
4001  DEFINE_ENTRY_ACCESSORS(Pc, Smi)
4002
4003#undef DEFINE_ENTRY_ACCESSORS
4004
4005  int DeoptCount() {
4006    return (length() - kFirstDeoptEntryIndex) / kDeoptEntrySize;
4007  }
4008
4009  // Allocates a DeoptimizationInputData.
4010  MUST_USE_RESULT static MaybeObject* Allocate(int deopt_entry_count,
4011                                               PretenureFlag pretenure);
4012
4013  // Casting.
4014  static inline DeoptimizationInputData* cast(Object* obj);
4015
4016#ifdef ENABLE_DISASSEMBLER
4017  void DeoptimizationInputDataPrint(FILE* out);
4018#endif
4019
4020 private:
4021  static int IndexForEntry(int i) {
4022    return kFirstDeoptEntryIndex + (i * kDeoptEntrySize);
4023  }
4024
4025  static int LengthFor(int entry_count) {
4026    return IndexForEntry(entry_count);
4027  }
4028};
4029
4030
4031// DeoptimizationOutputData is a fixed array used to hold the deoptimization
4032// data for code generated by the full compiler.
4033// The format of the these objects is
4034//   [i * 2]: Ast ID for ith deoptimization.
4035//   [i * 2 + 1]: PC and state of ith deoptimization
4036class DeoptimizationOutputData: public FixedArray {
4037 public:
4038  int DeoptPoints() { return length() / 2; }
4039  Smi* AstId(int index) { return Smi::cast(get(index * 2)); }
4040  void SetAstId(int index, Smi* id) { set(index * 2, id); }
4041  Smi* PcAndState(int index) { return Smi::cast(get(1 + index * 2)); }
4042  void SetPcAndState(int index, Smi* offset) { set(1 + index * 2, offset); }
4043
4044  static int LengthOfFixedArray(int deopt_points) {
4045    return deopt_points * 2;
4046  }
4047
4048  // Allocates a DeoptimizationOutputData.
4049  MUST_USE_RESULT static MaybeObject* Allocate(int number_of_deopt_points,
4050                                               PretenureFlag pretenure);
4051
4052  // Casting.
4053  static inline DeoptimizationOutputData* cast(Object* obj);
4054
4055#if defined(OBJECT_PRINT) || defined(ENABLE_DISASSEMBLER)
4056  void DeoptimizationOutputDataPrint(FILE* out);
4057#endif
4058};
4059
4060
4061// Forward declaration.
4062class JSGlobalPropertyCell;
4063
4064// TypeFeedbackCells is a fixed array used to hold the association between
4065// cache cells and AST ids for code generated by the full compiler.
4066// The format of the these objects is
4067//   [i * 2]: Global property cell of ith cache cell.
4068//   [i * 2 + 1]: Ast ID for ith cache cell.
4069class TypeFeedbackCells: public FixedArray {
4070 public:
4071  int CellCount() { return length() / 2; }
4072  static int LengthOfFixedArray(int cell_count) { return cell_count * 2; }
4073
4074  // Accessors for AST ids associated with cache values.
4075  inline Smi* AstId(int index);
4076  inline void SetAstId(int index, Smi* id);
4077
4078  // Accessors for global property cells holding the cache values.
4079  inline JSGlobalPropertyCell* Cell(int index);
4080  inline void SetCell(int index, JSGlobalPropertyCell* cell);
4081
4082  // The object that indicates an uninitialized cache.
4083  static inline Handle<Object> UninitializedSentinel(Isolate* isolate);
4084
4085  // The object that indicates a megamorphic state.
4086  static inline Handle<Object> MegamorphicSentinel(Isolate* isolate);
4087
4088  // A raw version of the uninitialized sentinel that's safe to read during
4089  // garbage collection (e.g., for patching the cache).
4090  static inline Object* RawUninitializedSentinel(Heap* heap);
4091
4092  // Casting.
4093  static inline TypeFeedbackCells* cast(Object* obj);
4094
4095  static const int kForInFastCaseMarker = 0;
4096  static const int kForInSlowCaseMarker = 1;
4097};
4098
4099
4100// Forward declaration.
4101class SafepointEntry;
4102class TypeFeedbackInfo;
4103
4104// Code describes objects with on-the-fly generated machine code.
4105class Code: public HeapObject {
4106 public:
4107  // Opaque data type for encapsulating code flags like kind, inline
4108  // cache state, and arguments count.
4109  // FLAGS_MIN_VALUE and FLAGS_MAX_VALUE are specified to ensure that
4110  // enumeration type has correct value range (see Issue 830 for more details).
4111  enum Flags {
4112    FLAGS_MIN_VALUE = kMinInt,
4113    FLAGS_MAX_VALUE = kMaxInt
4114  };
4115
4116  enum Kind {
4117    FUNCTION,
4118    OPTIMIZED_FUNCTION,
4119    STUB,
4120    BUILTIN,
4121    LOAD_IC,
4122    KEYED_LOAD_IC,
4123    CALL_IC,
4124    KEYED_CALL_IC,
4125    STORE_IC,
4126    KEYED_STORE_IC,
4127    UNARY_OP_IC,
4128    BINARY_OP_IC,
4129    COMPARE_IC,
4130    TO_BOOLEAN_IC,
4131    // No more than 16 kinds. The value currently encoded in four bits in
4132    // Flags.
4133
4134    // Pseudo-kinds.
4135    REGEXP = BUILTIN,
4136    FIRST_IC_KIND = LOAD_IC,
4137    LAST_IC_KIND = TO_BOOLEAN_IC
4138  };
4139
4140  enum {
4141    NUMBER_OF_KINDS = LAST_IC_KIND + 1
4142  };
4143
4144  typedef int ExtraICState;
4145
4146  static const ExtraICState kNoExtraICState = 0;
4147
4148#ifdef ENABLE_DISASSEMBLER
4149  // Printing
4150  static const char* Kind2String(Kind kind);
4151  static const char* ICState2String(InlineCacheState state);
4152  static const char* PropertyType2String(PropertyType type);
4153  static void PrintExtraICState(FILE* out, Kind kind, ExtraICState extra);
4154  inline void Disassemble(const char* name) {
4155    Disassemble(name, stdout);
4156  }
4157  void Disassemble(const char* name, FILE* out);
4158#endif  // ENABLE_DISASSEMBLER
4159
4160  // [instruction_size]: Size of the native instructions
4161  inline int instruction_size();
4162  inline void set_instruction_size(int value);
4163
4164  // [relocation_info]: Code relocation information
4165  DECL_ACCESSORS(relocation_info, ByteArray)
4166  void InvalidateRelocation();
4167
4168  // [handler_table]: Fixed array containing offsets of exception handlers.
4169  DECL_ACCESSORS(handler_table, FixedArray)
4170
4171  // [deoptimization_data]: Array containing data for deopt.
4172  DECL_ACCESSORS(deoptimization_data, FixedArray)
4173
4174  // [type_feedback_info]: Struct containing type feedback information.
4175  // Will contain either a TypeFeedbackInfo object, or undefined.
4176  DECL_ACCESSORS(type_feedback_info, Object)
4177
4178  // [gc_metadata]: Field used to hold GC related metadata. The contents of this
4179  // field does not have to be traced during garbage collection since
4180  // it is only used by the garbage collector itself.
4181  DECL_ACCESSORS(gc_metadata, Object)
4182
4183  // [ic_age]: Inline caching age: the value of the Heap::global_ic_age
4184  // at the moment when this object was created.
4185  inline void set_ic_age(int count);
4186  inline int ic_age();
4187
4188  // Unchecked accessors to be used during GC.
4189  inline ByteArray* unchecked_relocation_info();
4190  inline FixedArray* unchecked_deoptimization_data();
4191
4192  inline int relocation_size();
4193
4194  // [flags]: Various code flags.
4195  inline Flags flags();
4196  inline void set_flags(Flags flags);
4197
4198  // [flags]: Access to specific code flags.
4199  inline Kind kind();
4200  inline InlineCacheState ic_state();  // Only valid for IC stubs.
4201  inline ExtraICState extra_ic_state();  // Only valid for IC stubs.
4202  inline PropertyType type();  // Only valid for monomorphic IC stubs.
4203  inline int arguments_count();  // Only valid for call IC stubs.
4204
4205  // Testers for IC stub kinds.
4206  inline bool is_inline_cache_stub();
4207  inline bool is_load_stub() { return kind() == LOAD_IC; }
4208  inline bool is_keyed_load_stub() { return kind() == KEYED_LOAD_IC; }
4209  inline bool is_store_stub() { return kind() == STORE_IC; }
4210  inline bool is_keyed_store_stub() { return kind() == KEYED_STORE_IC; }
4211  inline bool is_call_stub() { return kind() == CALL_IC; }
4212  inline bool is_keyed_call_stub() { return kind() == KEYED_CALL_IC; }
4213  inline bool is_unary_op_stub() { return kind() == UNARY_OP_IC; }
4214  inline bool is_binary_op_stub() { return kind() == BINARY_OP_IC; }
4215  inline bool is_compare_ic_stub() { return kind() == COMPARE_IC; }
4216  inline bool is_to_boolean_ic_stub() { return kind() == TO_BOOLEAN_IC; }
4217
4218  // [major_key]: For kind STUB or BINARY_OP_IC, the major key.
4219  inline int major_key();
4220  inline void set_major_key(int value);
4221
4222  // For stubs, tells whether they should always exist, so that they can be
4223  // called from other stubs.
4224  inline bool is_pregenerated();
4225  inline void set_is_pregenerated(bool value);
4226
4227  // [optimizable]: For FUNCTION kind, tells if it is optimizable.
4228  inline bool optimizable();
4229  inline void set_optimizable(bool value);
4230
4231  // [has_deoptimization_support]: For FUNCTION kind, tells if it has
4232  // deoptimization support.
4233  inline bool has_deoptimization_support();
4234  inline void set_has_deoptimization_support(bool value);
4235
4236  // [has_debug_break_slots]: For FUNCTION kind, tells if it has
4237  // been compiled with debug break slots.
4238  inline bool has_debug_break_slots();
4239  inline void set_has_debug_break_slots(bool value);
4240
4241  // [compiled_with_optimizing]: For FUNCTION kind, tells if it has
4242  // been compiled with IsOptimizing set to true.
4243  inline bool is_compiled_optimizable();
4244  inline void set_compiled_optimizable(bool value);
4245
4246  // [has_self_optimization_header]: For FUNCTION kind, tells if it has
4247  // a self-optimization header.
4248  inline bool has_self_optimization_header();
4249  inline void set_self_optimization_header(bool value);
4250
4251  // [allow_osr_at_loop_nesting_level]: For FUNCTION kind, tells for
4252  // how long the function has been marked for OSR and therefore which
4253  // level of loop nesting we are willing to do on-stack replacement
4254  // for.
4255  inline void set_allow_osr_at_loop_nesting_level(int level);
4256  inline int allow_osr_at_loop_nesting_level();
4257
4258  // [profiler_ticks]: For FUNCTION kind, tells for how many profiler ticks
4259  // the code object was seen on the stack with no IC patching going on.
4260  inline int profiler_ticks();
4261  inline void set_profiler_ticks(int ticks);
4262
4263  // [stack_slots]: For kind OPTIMIZED_FUNCTION, the number of stack slots
4264  // reserved in the code prologue.
4265  inline unsigned stack_slots();
4266  inline void set_stack_slots(unsigned slots);
4267
4268  // [safepoint_table_start]: For kind OPTIMIZED_CODE, the offset in
4269  // the instruction stream where the safepoint table starts.
4270  inline unsigned safepoint_table_offset();
4271  inline void set_safepoint_table_offset(unsigned offset);
4272
4273  // [stack_check_table_start]: For kind FUNCTION, the offset in the
4274  // instruction stream where the stack check table starts.
4275  inline unsigned stack_check_table_offset();
4276  inline void set_stack_check_table_offset(unsigned offset);
4277
4278  // [check type]: For kind CALL_IC, tells how to check if the
4279  // receiver is valid for the given call.
4280  inline CheckType check_type();
4281  inline void set_check_type(CheckType value);
4282
4283  // [type-recording unary op type]: For kind UNARY_OP_IC.
4284  inline byte unary_op_type();
4285  inline void set_unary_op_type(byte value);
4286
4287  // [type-recording binary op type]: For kind BINARY_OP_IC.
4288  inline byte binary_op_type();
4289  inline void set_binary_op_type(byte value);
4290  inline byte binary_op_result_type();
4291  inline void set_binary_op_result_type(byte value);
4292
4293  // [compare state]: For kind COMPARE_IC, tells what state the stub is in.
4294  inline byte compare_state();
4295  inline void set_compare_state(byte value);
4296
4297  // [to_boolean_foo]: For kind TO_BOOLEAN_IC tells what state the stub is in.
4298  inline byte to_boolean_state();
4299  inline void set_to_boolean_state(byte value);
4300
4301  // [has_function_cache]: For kind STUB tells whether there is a function
4302  // cache is passed to the stub.
4303  inline bool has_function_cache();
4304  inline void set_has_function_cache(bool flag);
4305
4306  // Get the safepoint entry for the given pc.
4307  SafepointEntry GetSafepointEntry(Address pc);
4308
4309  // Mark this code object as not having a stack check table.  Assumes kind
4310  // is FUNCTION.
4311  void SetNoStackCheckTable();
4312
4313  // Find the first map in an IC stub.
4314  Map* FindFirstMap();
4315
4316  class ExtraICStateStrictMode: public BitField<StrictModeFlag, 0, 1> {};
4317  class ExtraICStateKeyedAccessGrowMode:
4318      public BitField<KeyedAccessGrowMode, 1, 1> {};  // NOLINT
4319
4320  static const int kExtraICStateGrowModeShift = 1;
4321
4322  static inline StrictModeFlag GetStrictMode(ExtraICState extra_ic_state) {
4323    return ExtraICStateStrictMode::decode(extra_ic_state);
4324  }
4325
4326  static inline KeyedAccessGrowMode GetKeyedAccessGrowMode(
4327      ExtraICState extra_ic_state) {
4328    return ExtraICStateKeyedAccessGrowMode::decode(extra_ic_state);
4329  }
4330
4331  static inline ExtraICState ComputeExtraICState(
4332      KeyedAccessGrowMode grow_mode,
4333      StrictModeFlag strict_mode) {
4334    return ExtraICStateKeyedAccessGrowMode::encode(grow_mode) |
4335        ExtraICStateStrictMode::encode(strict_mode);
4336  }
4337
4338  // Flags operations.
4339  static inline Flags ComputeFlags(
4340      Kind kind,
4341      InlineCacheState ic_state = UNINITIALIZED,
4342      ExtraICState extra_ic_state = kNoExtraICState,
4343      PropertyType type = NORMAL,
4344      int argc = -1,
4345      InlineCacheHolderFlag holder = OWN_MAP);
4346
4347  static inline Flags ComputeMonomorphicFlags(
4348      Kind kind,
4349      PropertyType type,
4350      ExtraICState extra_ic_state = kNoExtraICState,
4351      InlineCacheHolderFlag holder = OWN_MAP,
4352      int argc = -1);
4353
4354  static inline InlineCacheState ExtractICStateFromFlags(Flags flags);
4355  static inline PropertyType ExtractTypeFromFlags(Flags flags);
4356  static inline Kind ExtractKindFromFlags(Flags flags);
4357  static inline InlineCacheHolderFlag ExtractCacheHolderFromFlags(Flags flags);
4358  static inline ExtraICState ExtractExtraICStateFromFlags(Flags flags);
4359  static inline int ExtractArgumentsCountFromFlags(Flags flags);
4360
4361  static inline Flags RemoveTypeFromFlags(Flags flags);
4362
4363  // Convert a target address into a code object.
4364  static inline Code* GetCodeFromTargetAddress(Address address);
4365
4366  // Convert an entry address into an object.
4367  static inline Object* GetObjectFromEntryAddress(Address location_of_address);
4368
4369  // Returns the address of the first instruction.
4370  inline byte* instruction_start();
4371
4372  // Returns the address right after the last instruction.
4373  inline byte* instruction_end();
4374
4375  // Returns the size of the instructions, padding, and relocation information.
4376  inline int body_size();
4377
4378  // Returns the address of the first relocation info (read backwards!).
4379  inline byte* relocation_start();
4380
4381  // Code entry point.
4382  inline byte* entry();
4383
4384  // Returns true if pc is inside this object's instructions.
4385  inline bool contains(byte* pc);
4386
4387  // Relocate the code by delta bytes. Called to signal that this code
4388  // object has been moved by delta bytes.
4389  void Relocate(intptr_t delta);
4390
4391  // Migrate code described by desc.
4392  void CopyFrom(const CodeDesc& desc);
4393
4394  // Returns the object size for a given body (used for allocation).
4395  static int SizeFor(int body_size) {
4396    ASSERT_SIZE_TAG_ALIGNED(body_size);
4397    return RoundUp(kHeaderSize + body_size, kCodeAlignment);
4398  }
4399
4400  // Calculate the size of the code object to report for log events. This takes
4401  // the layout of the code object into account.
4402  int ExecutableSize() {
4403    // Check that the assumptions about the layout of the code object holds.
4404    ASSERT_EQ(static_cast<int>(instruction_start() - address()),
4405              Code::kHeaderSize);
4406    return instruction_size() + Code::kHeaderSize;
4407  }
4408
4409  // Locating source position.
4410  int SourcePosition(Address pc);
4411  int SourceStatementPosition(Address pc);
4412
4413  // Casting.
4414  static inline Code* cast(Object* obj);
4415
4416  // Dispatched behavior.
4417  int CodeSize() { return SizeFor(body_size()); }
4418  inline void CodeIterateBody(ObjectVisitor* v);
4419
4420  template<typename StaticVisitor>
4421  inline void CodeIterateBody(Heap* heap);
4422#ifdef OBJECT_PRINT
4423  inline void CodePrint() {
4424    CodePrint(stdout);
4425  }
4426  void CodePrint(FILE* out);
4427#endif
4428#ifdef DEBUG
4429  void CodeVerify();
4430#endif
4431  void ClearInlineCaches();
4432
4433  // Max loop nesting marker used to postpose OSR. We don't take loop
4434  // nesting that is deeper than 5 levels into account.
4435  static const int kMaxLoopNestingMarker = 6;
4436
4437  // Layout description.
4438  static const int kInstructionSizeOffset = HeapObject::kHeaderSize;
4439  static const int kRelocationInfoOffset = kInstructionSizeOffset + kIntSize;
4440  static const int kHandlerTableOffset = kRelocationInfoOffset + kPointerSize;
4441  static const int kDeoptimizationDataOffset =
4442      kHandlerTableOffset + kPointerSize;
4443  static const int kTypeFeedbackInfoOffset =
4444      kDeoptimizationDataOffset + kPointerSize;
4445  static const int kGCMetadataOffset = kTypeFeedbackInfoOffset + kPointerSize;
4446  static const int kICAgeOffset =
4447      kGCMetadataOffset + kPointerSize;
4448  static const int kFlagsOffset = kICAgeOffset + kIntSize;
4449  static const int kKindSpecificFlagsOffset = kFlagsOffset + kIntSize;
4450  static const int kKindSpecificFlagsSize = 2 * kIntSize;
4451
4452  static const int kHeaderPaddingStart = kKindSpecificFlagsOffset +
4453      kKindSpecificFlagsSize;
4454
4455  // Add padding to align the instruction start following right after
4456  // the Code object header.
4457  static const int kHeaderSize =
4458      (kHeaderPaddingStart + kCodeAlignmentMask) & ~kCodeAlignmentMask;
4459
4460  // Byte offsets within kKindSpecificFlagsOffset.
4461  static const int kStubMajorKeyOffset = kKindSpecificFlagsOffset;
4462  static const int kOptimizableOffset = kKindSpecificFlagsOffset;
4463  static const int kStackSlotsOffset = kKindSpecificFlagsOffset;
4464  static const int kCheckTypeOffset = kKindSpecificFlagsOffset;
4465
4466  static const int kUnaryOpTypeOffset = kStubMajorKeyOffset + 1;
4467  static const int kBinaryOpTypeOffset = kStubMajorKeyOffset + 1;
4468  static const int kCompareStateOffset = kStubMajorKeyOffset + 1;
4469  static const int kToBooleanTypeOffset = kStubMajorKeyOffset + 1;
4470  static const int kHasFunctionCacheOffset = kStubMajorKeyOffset + 1;
4471
4472  static const int kFullCodeFlags = kOptimizableOffset + 1;
4473  class FullCodeFlagsHasDeoptimizationSupportField:
4474      public BitField<bool, 0, 1> {};  // NOLINT
4475  class FullCodeFlagsHasDebugBreakSlotsField: public BitField<bool, 1, 1> {};
4476  class FullCodeFlagsIsCompiledOptimizable: public BitField<bool, 2, 1> {};
4477  class FullCodeFlagsHasSelfOptimizationHeader: public BitField<bool, 3, 1> {};
4478
4479  static const int kBinaryOpReturnTypeOffset = kBinaryOpTypeOffset + 1;
4480
4481  static const int kAllowOSRAtLoopNestingLevelOffset = kFullCodeFlags + 1;
4482  static const int kProfilerTicksOffset = kAllowOSRAtLoopNestingLevelOffset + 1;
4483
4484  static const int kSafepointTableOffsetOffset = kStackSlotsOffset + kIntSize;
4485  static const int kStackCheckTableOffsetOffset = kStackSlotsOffset + kIntSize;
4486
4487  // Flags layout.  BitField<type, shift, size>.
4488  class ICStateField: public BitField<InlineCacheState, 0, 3> {};
4489  class TypeField: public BitField<PropertyType, 3, 4> {};
4490  class CacheHolderField: public BitField<InlineCacheHolderFlag, 7, 1> {};
4491  class KindField: public BitField<Kind, 8, 4> {};
4492  class ExtraICStateField: public BitField<ExtraICState, 12, 2> {};
4493  class IsPregeneratedField: public BitField<bool, 14, 1> {};
4494
4495  // Signed field cannot be encoded using the BitField class.
4496  static const int kArgumentsCountShift = 15;
4497  static const int kArgumentsCountMask = ~((1 << kArgumentsCountShift) - 1);
4498
4499  // This constant should be encodable in an ARM instruction.
4500  static const int kFlagsNotUsedInLookup =
4501      TypeField::kMask | CacheHolderField::kMask;
4502
4503 private:
4504  DISALLOW_IMPLICIT_CONSTRUCTORS(Code);
4505};
4506
4507
4508// All heap objects have a Map that describes their structure.
4509//  A Map contains information about:
4510//  - Size information about the object
4511//  - How to iterate over an object (for garbage collection)
4512class Map: public HeapObject {
4513 public:
4514  // Instance size.
4515  // Size in bytes or kVariableSizeSentinel if instances do not have
4516  // a fixed size.
4517  inline int instance_size();
4518  inline void set_instance_size(int value);
4519
4520  // Count of properties allocated in the object.
4521  inline int inobject_properties();
4522  inline void set_inobject_properties(int value);
4523
4524  // Count of property fields pre-allocated in the object when first allocated.
4525  inline int pre_allocated_property_fields();
4526  inline void set_pre_allocated_property_fields(int value);
4527
4528  // Instance type.
4529  inline InstanceType instance_type();
4530  inline void set_instance_type(InstanceType value);
4531
4532  // Tells how many unused property fields are available in the
4533  // instance (only used for JSObject in fast mode).
4534  inline int unused_property_fields();
4535  inline void set_unused_property_fields(int value);
4536
4537  // Bit field.
4538  inline byte bit_field();
4539  inline void set_bit_field(byte value);
4540
4541  // Bit field 2.
4542  inline byte bit_field2();
4543  inline void set_bit_field2(byte value);
4544
4545  // Bit field 3.
4546  // TODO(1399): It should be possible to make room for bit_field3 in the map
4547  // without overloading the instance descriptors field (and storing it in the
4548  // DescriptorArray when the map has one).
4549  inline int bit_field3();
4550  inline void set_bit_field3(int value);
4551
4552  // Tells whether the object in the prototype property will be used
4553  // for instances created from this function.  If the prototype
4554  // property is set to a value that is not a JSObject, the prototype
4555  // property will not be used to create instances of the function.
4556  // See ECMA-262, 13.2.2.
4557  inline void set_non_instance_prototype(bool value);
4558  inline bool has_non_instance_prototype();
4559
4560  // Tells whether function has special prototype property. If not, prototype
4561  // property will not be created when accessed (will return undefined),
4562  // and construction from this function will not be allowed.
4563  inline void set_function_with_prototype(bool value);
4564  inline bool function_with_prototype();
4565
4566  // Tells whether the instance with this map should be ignored by the
4567  // __proto__ accessor.
4568  inline void set_is_hidden_prototype() {
4569    set_bit_field(bit_field() | (1 << kIsHiddenPrototype));
4570  }
4571
4572  inline bool is_hidden_prototype() {
4573    return ((1 << kIsHiddenPrototype) & bit_field()) != 0;
4574  }
4575
4576  // Records and queries whether the instance has a named interceptor.
4577  inline void set_has_named_interceptor() {
4578    set_bit_field(bit_field() | (1 << kHasNamedInterceptor));
4579  }
4580
4581  inline bool has_named_interceptor() {
4582    return ((1 << kHasNamedInterceptor) & bit_field()) != 0;
4583  }
4584
4585  // Records and queries whether the instance has an indexed interceptor.
4586  inline void set_has_indexed_interceptor() {
4587    set_bit_field(bit_field() | (1 << kHasIndexedInterceptor));
4588  }
4589
4590  inline bool has_indexed_interceptor() {
4591    return ((1 << kHasIndexedInterceptor) & bit_field()) != 0;
4592  }
4593
4594  // Tells whether the instance is undetectable.
4595  // An undetectable object is a special class of JSObject: 'typeof' operator
4596  // returns undefined, ToBoolean returns false. Otherwise it behaves like
4597  // a normal JS object.  It is useful for implementing undetectable
4598  // document.all in Firefox & Safari.
4599  // See https://bugzilla.mozilla.org/show_bug.cgi?id=248549.
4600  inline void set_is_undetectable() {
4601    set_bit_field(bit_field() | (1 << kIsUndetectable));
4602  }
4603
4604  inline bool is_undetectable() {
4605    return ((1 << kIsUndetectable) & bit_field()) != 0;
4606  }
4607
4608  // Tells whether the instance has a call-as-function handler.
4609  inline void set_has_instance_call_handler() {
4610    set_bit_field(bit_field() | (1 << kHasInstanceCallHandler));
4611  }
4612
4613  inline bool has_instance_call_handler() {
4614    return ((1 << kHasInstanceCallHandler) & bit_field()) != 0;
4615  }
4616
4617  inline void set_is_extensible(bool value);
4618  inline bool is_extensible();
4619
4620  inline void set_elements_kind(ElementsKind elements_kind) {
4621    ASSERT(elements_kind < kElementsKindCount);
4622    ASSERT(kElementsKindCount <= (1 << kElementsKindBitCount));
4623    set_bit_field2((bit_field2() & ~kElementsKindMask) |
4624        (elements_kind << kElementsKindShift));
4625    ASSERT(this->elements_kind() == elements_kind);
4626  }
4627
4628  inline ElementsKind elements_kind() {
4629    return static_cast<ElementsKind>(
4630        (bit_field2() & kElementsKindMask) >> kElementsKindShift);
4631  }
4632
4633  // Tells whether the instance has fast elements that are only Smis.
4634  inline bool has_fast_smi_only_elements() {
4635    return elements_kind() == FAST_SMI_ONLY_ELEMENTS;
4636  }
4637
4638  // Tells whether the instance has fast elements.
4639  inline bool has_fast_elements() {
4640    return elements_kind() == FAST_ELEMENTS;
4641  }
4642
4643  inline bool has_fast_double_elements() {
4644    return elements_kind() == FAST_DOUBLE_ELEMENTS;
4645  }
4646
4647  inline bool has_non_strict_arguments_elements() {
4648    return elements_kind() == NON_STRICT_ARGUMENTS_ELEMENTS;
4649  }
4650
4651  inline bool has_external_array_elements() {
4652    ElementsKind kind(elements_kind());
4653    return kind >= FIRST_EXTERNAL_ARRAY_ELEMENTS_KIND &&
4654        kind <= LAST_EXTERNAL_ARRAY_ELEMENTS_KIND;
4655  }
4656
4657  inline bool has_dictionary_elements() {
4658    return elements_kind() == DICTIONARY_ELEMENTS;
4659  }
4660
4661  inline bool has_slow_elements_kind() {
4662    return elements_kind() == DICTIONARY_ELEMENTS
4663        || elements_kind() == NON_STRICT_ARGUMENTS_ELEMENTS;
4664  }
4665
4666  static bool IsValidElementsTransition(ElementsKind from_kind,
4667                                        ElementsKind to_kind);
4668
4669  // Tells whether the map is attached to SharedFunctionInfo
4670  // (for inobject slack tracking).
4671  inline void set_attached_to_shared_function_info(bool value);
4672
4673  inline bool attached_to_shared_function_info();
4674
4675  // Tells whether the map is shared between objects that may have different
4676  // behavior. If true, the map should never be modified, instead a clone
4677  // should be created and modified.
4678  inline void set_is_shared(bool value);
4679
4680  inline bool is_shared();
4681
4682  // Tells whether the instance needs security checks when accessing its
4683  // properties.
4684  inline void set_is_access_check_needed(bool access_check_needed);
4685  inline bool is_access_check_needed();
4686
4687  // [prototype]: implicit prototype object.
4688  DECL_ACCESSORS(prototype, Object)
4689
4690  // [constructor]: points back to the function responsible for this map.
4691  DECL_ACCESSORS(constructor, Object)
4692
4693  inline JSFunction* unchecked_constructor();
4694
4695  // Should only be called by the code that initializes map to set initial valid
4696  // value of the instance descriptor member.
4697  inline void init_instance_descriptors();
4698
4699  // [instance descriptors]: describes the object.
4700  DECL_ACCESSORS(instance_descriptors, DescriptorArray)
4701
4702  // Sets the instance descriptor array for the map to be an empty descriptor
4703  // array.
4704  inline void clear_instance_descriptors();
4705
4706  // [stub cache]: contains stubs compiled for this map.
4707  DECL_ACCESSORS(code_cache, Object)
4708
4709  // [prototype transitions]: cache of prototype transitions.
4710  // Prototype transition is a transition that happens
4711  // when we change object's prototype to a new one.
4712  // Cache format:
4713  //    0: finger - index of the first free cell in the cache
4714  //    1 + 2 * i: prototype
4715  //    2 + 2 * i: target map
4716  DECL_ACCESSORS(prototype_transitions, FixedArray)
4717
4718  inline FixedArray* unchecked_prototype_transitions();
4719
4720  static const int kProtoTransitionHeaderSize = 1;
4721  static const int kProtoTransitionNumberOfEntriesOffset = 0;
4722  static const int kProtoTransitionElementsPerEntry = 2;
4723  static const int kProtoTransitionPrototypeOffset = 0;
4724  static const int kProtoTransitionMapOffset = 1;
4725
4726  inline int NumberOfProtoTransitions() {
4727    FixedArray* cache = prototype_transitions();
4728    if (cache->length() == 0) return 0;
4729    return
4730        Smi::cast(cache->get(kProtoTransitionNumberOfEntriesOffset))->value();
4731  }
4732
4733  inline void SetNumberOfProtoTransitions(int value) {
4734    FixedArray* cache = prototype_transitions();
4735    ASSERT(cache->length() != 0);
4736    cache->set_unchecked(kProtoTransitionNumberOfEntriesOffset,
4737                         Smi::FromInt(value));
4738  }
4739
4740  // Lookup in the map's instance descriptors and fill out the result
4741  // with the given holder if the name is found. The holder may be
4742  // NULL when this function is used from the compiler.
4743  void LookupInDescriptors(JSObject* holder,
4744                           String* name,
4745                           LookupResult* result);
4746
4747  MUST_USE_RESULT MaybeObject* CopyDropDescriptors();
4748
4749  MUST_USE_RESULT MaybeObject* CopyNormalized(PropertyNormalizationMode mode,
4750                                              NormalizedMapSharingMode sharing);
4751
4752  // Returns a copy of the map, with all transitions dropped from the
4753  // instance descriptors.
4754  MUST_USE_RESULT MaybeObject* CopyDropTransitions();
4755
4756  // Returns the property index for name (only valid for FAST MODE).
4757  int PropertyIndexFor(String* name);
4758
4759  // Returns the next free property index (only valid for FAST MODE).
4760  int NextFreePropertyIndex();
4761
4762  // Returns the number of properties described in instance_descriptors
4763  // filtering out properties with the specified attributes.
4764  int NumberOfDescribedProperties(PropertyAttributes filter = NONE);
4765
4766  // Casting.
4767  static inline Map* cast(Object* obj);
4768
4769  // Locate an accessor in the instance descriptor.
4770  AccessorDescriptor* FindAccessor(String* name);
4771
4772  // Code cache operations.
4773
4774  // Clears the code cache.
4775  inline void ClearCodeCache(Heap* heap);
4776
4777  // Update code cache.
4778  static void UpdateCodeCache(Handle<Map> map,
4779                              Handle<String> name,
4780                              Handle<Code> code);
4781  MUST_USE_RESULT MaybeObject* UpdateCodeCache(String* name, Code* code);
4782
4783  // Returns the found code or undefined if absent.
4784  Object* FindInCodeCache(String* name, Code::Flags flags);
4785
4786  // Returns the non-negative index of the code object if it is in the
4787  // cache and -1 otherwise.
4788  int IndexInCodeCache(Object* name, Code* code);
4789
4790  // Removes a code object from the code cache at the given index.
4791  void RemoveFromCodeCache(String* name, Code* code, int index);
4792
4793  // For every transition in this map, makes the transition's
4794  // target's prototype pointer point back to this map.
4795  // This is undone in MarkCompactCollector::ClearNonLiveTransitions().
4796  void CreateBackPointers();
4797
4798  void CreateOneBackPointer(Object* transition_target);
4799
4800  // Set all map transitions from this map to dead maps to null.
4801  // Also, restore the original prototype on the targets of these
4802  // transitions, so that we do not process this map again while
4803  // following back pointers.
4804  void ClearNonLiveTransitions(Heap* heap, Object* real_prototype);
4805
4806  // Restore a possible back pointer in the prototype field of object.
4807  // Return true in that case and false otherwise. Set *keep_entry to
4808  // true when a live map transition has been found.
4809  bool RestoreOneBackPointer(Object* object,
4810                             Object* real_prototype,
4811                             bool* keep_entry);
4812
4813  // Computes a hash value for this map, to be used in HashTables and such.
4814  int Hash();
4815
4816  // Compares this map to another to see if they describe equivalent objects.
4817  // If |mode| is set to CLEAR_INOBJECT_PROPERTIES, |other| is treated as if
4818  // it had exactly zero inobject properties.
4819  // The "shared" flags of both this map and |other| are ignored.
4820  bool EquivalentToForNormalization(Map* other, PropertyNormalizationMode mode);
4821
4822  // Returns the contents of this map's descriptor array for the given string.
4823  // May return NULL. |safe_to_add_transition| is set to false and NULL
4824  // is returned if adding transitions is not allowed.
4825  Object* GetDescriptorContents(String* sentinel_name,
4826                                bool* safe_to_add_transitions);
4827
4828  // Returns the map that this map transitions to if its elements_kind
4829  // is changed to |elements_kind|, or NULL if no such map is cached yet.
4830  // |safe_to_add_transitions| is set to false if adding transitions is not
4831  // allowed.
4832  Map* LookupElementsTransitionMap(ElementsKind elements_kind,
4833                                   bool* safe_to_add_transition);
4834
4835  // Adds an entry to this map's descriptor array for a transition to
4836  // |transitioned_map| when its elements_kind is changed to |elements_kind|.
4837  MUST_USE_RESULT MaybeObject* AddElementsTransition(
4838      ElementsKind elements_kind, Map* transitioned_map);
4839
4840  // Returns the transitioned map for this map with the most generic
4841  // elements_kind that's found in |candidates|, or null handle if no match is
4842  // found at all.
4843  Handle<Map> FindTransitionedMap(MapHandleList* candidates);
4844  Map* FindTransitionedMap(MapList* candidates);
4845
4846
4847  // Dispatched behavior.
4848#ifdef OBJECT_PRINT
4849  inline void MapPrint() {
4850    MapPrint(stdout);
4851  }
4852  void MapPrint(FILE* out);
4853#endif
4854#ifdef DEBUG
4855  void MapVerify();
4856  void SharedMapVerify();
4857#endif
4858
4859  inline int visitor_id();
4860  inline void set_visitor_id(int visitor_id);
4861
4862  typedef void (*TraverseCallback)(Map* map, void* data);
4863
4864  void TraverseTransitionTree(TraverseCallback callback, void* data);
4865
4866  static const int kMaxCachedPrototypeTransitions = 256;
4867
4868  Object* GetPrototypeTransition(Object* prototype);
4869
4870  MUST_USE_RESULT MaybeObject* PutPrototypeTransition(Object* prototype,
4871                                                      Map* map);
4872
4873  static const int kMaxPreAllocatedPropertyFields = 255;
4874
4875  // Layout description.
4876  static const int kInstanceSizesOffset = HeapObject::kHeaderSize;
4877  static const int kInstanceAttributesOffset = kInstanceSizesOffset + kIntSize;
4878  static const int kPrototypeOffset = kInstanceAttributesOffset + kIntSize;
4879  static const int kConstructorOffset = kPrototypeOffset + kPointerSize;
4880  // Storage for instance descriptors is overloaded to also contain additional
4881  // map flags when unused (bit_field3). When the map has instance descriptors,
4882  // the flags are transferred to the instance descriptor array and accessed
4883  // through an extra indirection.
4884  // TODO(1399): It should be possible to make room for bit_field3 in the map
4885  // without overloading the instance descriptors field, but the map is
4886  // currently perfectly aligned to 32 bytes and extending it at all would
4887  // double its size.  After the increment GC work lands, this size restriction
4888  // could be loosened and bit_field3 moved directly back in the map.
4889  static const int kInstanceDescriptorsOrBitField3Offset =
4890      kConstructorOffset + kPointerSize;
4891  static const int kCodeCacheOffset =
4892      kInstanceDescriptorsOrBitField3Offset + kPointerSize;
4893  static const int kPrototypeTransitionsOffset =
4894      kCodeCacheOffset + kPointerSize;
4895  static const int kPadStart = kPrototypeTransitionsOffset + kPointerSize;
4896  static const int kSize = MAP_POINTER_ALIGN(kPadStart);
4897
4898  // Layout of pointer fields. Heap iteration code relies on them
4899  // being continuously allocated.
4900  static const int kPointerFieldsBeginOffset = Map::kPrototypeOffset;
4901  static const int kPointerFieldsEndOffset =
4902      Map::kPrototypeTransitionsOffset + kPointerSize;
4903
4904  // Byte offsets within kInstanceSizesOffset.
4905  static const int kInstanceSizeOffset = kInstanceSizesOffset + 0;
4906  static const int kInObjectPropertiesByte = 1;
4907  static const int kInObjectPropertiesOffset =
4908      kInstanceSizesOffset + kInObjectPropertiesByte;
4909  static const int kPreAllocatedPropertyFieldsByte = 2;
4910  static const int kPreAllocatedPropertyFieldsOffset =
4911      kInstanceSizesOffset + kPreAllocatedPropertyFieldsByte;
4912  static const int kVisitorIdByte = 3;
4913  static const int kVisitorIdOffset = kInstanceSizesOffset + kVisitorIdByte;
4914
4915  // Byte offsets within kInstanceAttributesOffset attributes.
4916  static const int kInstanceTypeOffset = kInstanceAttributesOffset + 0;
4917  static const int kUnusedPropertyFieldsOffset = kInstanceAttributesOffset + 1;
4918  static const int kBitFieldOffset = kInstanceAttributesOffset + 2;
4919  static const int kBitField2Offset = kInstanceAttributesOffset + 3;
4920
4921  STATIC_CHECK(kInstanceTypeOffset == Internals::kMapInstanceTypeOffset);
4922
4923  // Bit positions for bit field.
4924  static const int kUnused = 0;  // To be used for marking recently used maps.
4925  static const int kHasNonInstancePrototype = 1;
4926  static const int kIsHiddenPrototype = 2;
4927  static const int kHasNamedInterceptor = 3;
4928  static const int kHasIndexedInterceptor = 4;
4929  static const int kIsUndetectable = 5;
4930  static const int kHasInstanceCallHandler = 6;
4931  static const int kIsAccessCheckNeeded = 7;
4932
4933  // Bit positions for bit field 2
4934  static const int kIsExtensible = 0;
4935  static const int kFunctionWithPrototype = 1;
4936  static const int kStringWrapperSafeForDefaultValueOf = 2;
4937  static const int kAttachedToSharedFunctionInfo = 3;
4938  // No bits can be used after kElementsKindFirstBit, they are all reserved for
4939  // storing ElementKind.
4940  static const int kElementsKindShift = 4;
4941  static const int kElementsKindBitCount = 4;
4942
4943  // Derived values from bit field 2
4944  static const int kElementsKindMask = (-1 << kElementsKindShift) &
4945      ((1 << (kElementsKindShift + kElementsKindBitCount)) - 1);
4946  static const int8_t kMaximumBitField2FastElementValue = static_cast<int8_t>(
4947      (FAST_ELEMENTS + 1) << Map::kElementsKindShift) - 1;
4948  static const int8_t kMaximumBitField2FastSmiOnlyElementValue =
4949      static_cast<int8_t>((FAST_SMI_ONLY_ELEMENTS + 1) <<
4950                          Map::kElementsKindShift) - 1;
4951
4952  // Bit positions for bit field 3
4953  static const int kIsShared = 0;
4954
4955  // Layout of the default cache. It holds alternating name and code objects.
4956  static const int kCodeCacheEntrySize = 2;
4957  static const int kCodeCacheEntryNameOffset = 0;
4958  static const int kCodeCacheEntryCodeOffset = 1;
4959
4960  typedef FixedBodyDescriptor<kPointerFieldsBeginOffset,
4961                              kPointerFieldsEndOffset,
4962                              kSize> BodyDescriptor;
4963
4964 private:
4965  String* elements_transition_sentinel_name();
4966  DISALLOW_IMPLICIT_CONSTRUCTORS(Map);
4967};
4968
4969
4970// An abstract superclass, a marker class really, for simple structure classes.
4971// It doesn't carry much functionality but allows struct classes to be
4972// identified in the type system.
4973class Struct: public HeapObject {
4974 public:
4975  inline void InitializeBody(int object_size);
4976  static inline Struct* cast(Object* that);
4977};
4978
4979
4980// Script describes a script which has been added to the VM.
4981class Script: public Struct {
4982 public:
4983  // Script types.
4984  enum Type {
4985    TYPE_NATIVE = 0,
4986    TYPE_EXTENSION = 1,
4987    TYPE_NORMAL = 2
4988  };
4989
4990  // Script compilation types.
4991  enum CompilationType {
4992    COMPILATION_TYPE_HOST = 0,
4993    COMPILATION_TYPE_EVAL = 1
4994  };
4995
4996  // Script compilation state.
4997  enum CompilationState {
4998    COMPILATION_STATE_INITIAL = 0,
4999    COMPILATION_STATE_COMPILED = 1
5000  };
5001
5002  // [source]: the script source.
5003  DECL_ACCESSORS(source, Object)
5004
5005  // [name]: the script name.
5006  DECL_ACCESSORS(name, Object)
5007
5008  // [id]: the script id.
5009  DECL_ACCESSORS(id, Object)
5010
5011  // [line_offset]: script line offset in resource from where it was extracted.
5012  DECL_ACCESSORS(line_offset, Smi)
5013
5014  // [column_offset]: script column offset in resource from where it was
5015  // extracted.
5016  DECL_ACCESSORS(column_offset, Smi)
5017
5018  // [data]: additional data associated with this script.
5019  DECL_ACCESSORS(data, Object)
5020
5021  // [context_data]: context data for the context this script was compiled in.
5022  DECL_ACCESSORS(context_data, Object)
5023
5024  // [wrapper]: the wrapper cache.
5025  DECL_ACCESSORS(wrapper, Foreign)
5026
5027  // [type]: the script type.
5028  DECL_ACCESSORS(type, Smi)
5029
5030  // [compilation]: how the the script was compiled.
5031  DECL_ACCESSORS(compilation_type, Smi)
5032
5033  // [is_compiled]: determines whether the script has already been compiled.
5034  DECL_ACCESSORS(compilation_state, Smi)
5035
5036  // [line_ends]: FixedArray of line ends positions.
5037  DECL_ACCESSORS(line_ends, Object)
5038
5039  // [eval_from_shared]: for eval scripts the shared funcion info for the
5040  // function from which eval was called.
5041  DECL_ACCESSORS(eval_from_shared, Object)
5042
5043  // [eval_from_instructions_offset]: the instruction offset in the code for the
5044  // function from which eval was called where eval was called.
5045  DECL_ACCESSORS(eval_from_instructions_offset, Smi)
5046
5047  static inline Script* cast(Object* obj);
5048
5049  // If script source is an external string, check that the underlying
5050  // resource is accessible. Otherwise, always return true.
5051  inline bool HasValidSource();
5052
5053#ifdef OBJECT_PRINT
5054  inline void ScriptPrint() {
5055    ScriptPrint(stdout);
5056  }
5057  void ScriptPrint(FILE* out);
5058#endif
5059#ifdef DEBUG
5060  void ScriptVerify();
5061#endif
5062
5063  static const int kSourceOffset = HeapObject::kHeaderSize;
5064  static const int kNameOffset = kSourceOffset + kPointerSize;
5065  static const int kLineOffsetOffset = kNameOffset + kPointerSize;
5066  static const int kColumnOffsetOffset = kLineOffsetOffset + kPointerSize;
5067  static const int kDataOffset = kColumnOffsetOffset + kPointerSize;
5068  static const int kContextOffset = kDataOffset + kPointerSize;
5069  static const int kWrapperOffset = kContextOffset + kPointerSize;
5070  static const int kTypeOffset = kWrapperOffset + kPointerSize;
5071  static const int kCompilationTypeOffset = kTypeOffset + kPointerSize;
5072  static const int kCompilationStateOffset =
5073      kCompilationTypeOffset + kPointerSize;
5074  static const int kLineEndsOffset = kCompilationStateOffset + kPointerSize;
5075  static const int kIdOffset = kLineEndsOffset + kPointerSize;
5076  static const int kEvalFromSharedOffset = kIdOffset + kPointerSize;
5077  static const int kEvalFrominstructionsOffsetOffset =
5078      kEvalFromSharedOffset + kPointerSize;
5079  static const int kSize = kEvalFrominstructionsOffsetOffset + kPointerSize;
5080
5081 private:
5082  DISALLOW_IMPLICIT_CONSTRUCTORS(Script);
5083};
5084
5085
5086// List of builtin functions we want to identify to improve code
5087// generation.
5088//
5089// Each entry has a name of a global object property holding an object
5090// optionally followed by ".prototype", a name of a builtin function
5091// on the object (the one the id is set for), and a label.
5092//
5093// Installation of ids for the selected builtin functions is handled
5094// by the bootstrapper.
5095//
5096// NOTE: Order is important: math functions should be at the end of
5097// the list and MathFloor should be the first math function.
5098#define FUNCTIONS_WITH_ID_LIST(V)                   \
5099  V(Array.prototype, push, ArrayPush)               \
5100  V(Array.prototype, pop, ArrayPop)                 \
5101  V(Function.prototype, apply, FunctionApply)       \
5102  V(String.prototype, charCodeAt, StringCharCodeAt) \
5103  V(String.prototype, charAt, StringCharAt)         \
5104  V(String, fromCharCode, StringFromCharCode)       \
5105  V(Math, floor, MathFloor)                         \
5106  V(Math, round, MathRound)                         \
5107  V(Math, ceil, MathCeil)                           \
5108  V(Math, abs, MathAbs)                             \
5109  V(Math, log, MathLog)                             \
5110  V(Math, sin, MathSin)                             \
5111  V(Math, cos, MathCos)                             \
5112  V(Math, tan, MathTan)                             \
5113  V(Math, asin, MathASin)                           \
5114  V(Math, acos, MathACos)                           \
5115  V(Math, atan, MathATan)                           \
5116  V(Math, exp, MathExp)                             \
5117  V(Math, sqrt, MathSqrt)                           \
5118  V(Math, pow, MathPow)                             \
5119  V(Math, random, MathRandom)                       \
5120  V(Math, max, MathMax)                             \
5121  V(Math, min, MathMin)
5122
5123
5124enum BuiltinFunctionId {
5125#define DECLARE_FUNCTION_ID(ignored1, ignore2, name)    \
5126  k##name,
5127  FUNCTIONS_WITH_ID_LIST(DECLARE_FUNCTION_ID)
5128#undef DECLARE_FUNCTION_ID
5129  // Fake id for a special case of Math.pow. Note, it continues the
5130  // list of math functions.
5131  kMathPowHalf,
5132  kFirstMathFunctionId = kMathFloor
5133};
5134
5135
5136// SharedFunctionInfo describes the JSFunction information that can be
5137// shared by multiple instances of the function.
5138class SharedFunctionInfo: public HeapObject {
5139 public:
5140  // [name]: Function name.
5141  DECL_ACCESSORS(name, Object)
5142
5143  // [code]: Function code.
5144  DECL_ACCESSORS(code, Code)
5145
5146  // [scope_info]: Scope info.
5147  DECL_ACCESSORS(scope_info, ScopeInfo)
5148
5149  // [construct stub]: Code stub for constructing instances of this function.
5150  DECL_ACCESSORS(construct_stub, Code)
5151
5152  inline Code* unchecked_code();
5153
5154  // Returns if this function has been compiled to native code yet.
5155  inline bool is_compiled();
5156
5157  // [length]: The function length - usually the number of declared parameters.
5158  // Use up to 2^30 parameters.
5159  inline int length();
5160  inline void set_length(int value);
5161
5162  // [formal parameter count]: The declared number of parameters.
5163  inline int formal_parameter_count();
5164  inline void set_formal_parameter_count(int value);
5165
5166  // Set the formal parameter count so the function code will be
5167  // called without using argument adaptor frames.
5168  inline void DontAdaptArguments();
5169
5170  // [expected_nof_properties]: Expected number of properties for the function.
5171  inline int expected_nof_properties();
5172  inline void set_expected_nof_properties(int value);
5173
5174  // Inobject slack tracking is the way to reclaim unused inobject space.
5175  //
5176  // The instance size is initially determined by adding some slack to
5177  // expected_nof_properties (to allow for a few extra properties added
5178  // after the constructor). There is no guarantee that the extra space
5179  // will not be wasted.
5180  //
5181  // Here is the algorithm to reclaim the unused inobject space:
5182  // - Detect the first constructor call for this SharedFunctionInfo.
5183  //   When it happens enter the "in progress" state: remember the
5184  //   constructor's initial_map and install a special construct stub that
5185  //   counts constructor calls.
5186  // - While the tracking is in progress create objects filled with
5187  //   one_pointer_filler_map instead of undefined_value. This way they can be
5188  //   resized quickly and safely.
5189  // - Once enough (kGenerousAllocationCount) objects have been created
5190  //   compute the 'slack' (traverse the map transition tree starting from the
5191  //   initial_map and find the lowest value of unused_property_fields).
5192  // - Traverse the transition tree again and decrease the instance size
5193  //   of every map. Existing objects will resize automatically (they are
5194  //   filled with one_pointer_filler_map). All further allocations will
5195  //   use the adjusted instance size.
5196  // - Decrease expected_nof_properties so that an allocations made from
5197  //   another context will use the adjusted instance size too.
5198  // - Exit "in progress" state by clearing the reference to the initial_map
5199  //   and setting the regular construct stub (generic or inline).
5200  //
5201  //  The above is the main event sequence. Some special cases are possible
5202  //  while the tracking is in progress:
5203  //
5204  // - GC occurs.
5205  //   Check if the initial_map is referenced by any live objects (except this
5206  //   SharedFunctionInfo). If it is, continue tracking as usual.
5207  //   If it is not, clear the reference and reset the tracking state. The
5208  //   tracking will be initiated again on the next constructor call.
5209  //
5210  // - The constructor is called from another context.
5211  //   Immediately complete the tracking, perform all the necessary changes
5212  //   to maps. This is  necessary because there is no efficient way to track
5213  //   multiple initial_maps.
5214  //   Proceed to create an object in the current context (with the adjusted
5215  //   size).
5216  //
5217  // - A different constructor function sharing the same SharedFunctionInfo is
5218  //   called in the same context. This could be another closure in the same
5219  //   context, or the first function could have been disposed.
5220  //   This is handled the same way as the previous case.
5221  //
5222  //  Important: inobject slack tracking is not attempted during the snapshot
5223  //  creation.
5224
5225  static const int kGenerousAllocationCount = 8;
5226
5227  // [construction_count]: Counter for constructor calls made during
5228  // the tracking phase.
5229  inline int construction_count();
5230  inline void set_construction_count(int value);
5231
5232  // [initial_map]: initial map of the first function called as a constructor.
5233  // Saved for the duration of the tracking phase.
5234  // This is a weak link (GC resets it to undefined_value if no other live
5235  // object reference this map).
5236  DECL_ACCESSORS(initial_map, Object)
5237
5238  // True if the initial_map is not undefined and the countdown stub is
5239  // installed.
5240  inline bool IsInobjectSlackTrackingInProgress();
5241
5242  // Starts the tracking.
5243  // Stores the initial map and installs the countdown stub.
5244  // IsInobjectSlackTrackingInProgress is normally true after this call,
5245  // except when tracking have not been started (e.g. the map has no unused
5246  // properties or the snapshot is being built).
5247  void StartInobjectSlackTracking(Map* map);
5248
5249  // Completes the tracking.
5250  // IsInobjectSlackTrackingInProgress is false after this call.
5251  void CompleteInobjectSlackTracking();
5252
5253  // Clears the initial_map before the GC marking phase to ensure the reference
5254  // is weak. IsInobjectSlackTrackingInProgress is false after this call.
5255  void DetachInitialMap();
5256
5257  // Restores the link to the initial map after the GC marking phase.
5258  // IsInobjectSlackTrackingInProgress is true after this call.
5259  void AttachInitialMap(Map* map);
5260
5261  // False if there are definitely no live objects created from this function.
5262  // True if live objects _may_ exist (existence not guaranteed).
5263  // May go back from true to false after GC.
5264  DECL_BOOLEAN_ACCESSORS(live_objects_may_exist)
5265
5266  // [instance class name]: class name for instances.
5267  DECL_ACCESSORS(instance_class_name, Object)
5268
5269  // [function data]: This field holds some additional data for function.
5270  // Currently it either has FunctionTemplateInfo to make benefit the API
5271  // or Smi identifying a builtin function.
5272  // In the long run we don't want all functions to have this field but
5273  // we can fix that when we have a better model for storing hidden data
5274  // on objects.
5275  DECL_ACCESSORS(function_data, Object)
5276
5277  inline bool IsApiFunction();
5278  inline FunctionTemplateInfo* get_api_func_data();
5279  inline bool HasBuiltinFunctionId();
5280  inline BuiltinFunctionId builtin_function_id();
5281
5282  // [script info]: Script from which the function originates.
5283  DECL_ACCESSORS(script, Object)
5284
5285  // [num_literals]: Number of literals used by this function.
5286  inline int num_literals();
5287  inline void set_num_literals(int value);
5288
5289  // [start_position_and_type]: Field used to store both the source code
5290  // position, whether or not the function is a function expression,
5291  // and whether or not the function is a toplevel function. The two
5292  // least significants bit indicates whether the function is an
5293  // expression and the rest contains the source code position.
5294  inline int start_position_and_type();
5295  inline void set_start_position_and_type(int value);
5296
5297  // [debug info]: Debug information.
5298  DECL_ACCESSORS(debug_info, Object)
5299
5300  // [inferred name]: Name inferred from variable or property
5301  // assignment of this function. Used to facilitate debugging and
5302  // profiling of JavaScript code written in OO style, where almost
5303  // all functions are anonymous but are assigned to object
5304  // properties.
5305  DECL_ACCESSORS(inferred_name, String)
5306
5307  // The function's name if it is non-empty, otherwise the inferred name.
5308  String* DebugName();
5309
5310  // Position of the 'function' token in the script source.
5311  inline int function_token_position();
5312  inline void set_function_token_position(int function_token_position);
5313
5314  // Position of this function in the script source.
5315  inline int start_position();
5316  inline void set_start_position(int start_position);
5317
5318  // End position of this function in the script source.
5319  inline int end_position();
5320  inline void set_end_position(int end_position);
5321
5322  // Is this function a function expression in the source code.
5323  DECL_BOOLEAN_ACCESSORS(is_expression)
5324
5325  // Is this function a top-level function (scripts, evals).
5326  DECL_BOOLEAN_ACCESSORS(is_toplevel)
5327
5328  // Bit field containing various information collected by the compiler to
5329  // drive optimization.
5330  inline int compiler_hints();
5331  inline void set_compiler_hints(int value);
5332
5333  inline int ast_node_count();
5334  inline void set_ast_node_count(int count);
5335
5336  // A counter used to determine when to stress the deoptimizer with a
5337  // deopt.
5338  inline int deopt_counter();
5339  inline void set_deopt_counter(int counter);
5340
5341  // Inline cache age is used to infer whether the function survived a context
5342  // disposal or not. In the former case we reset the opt_count.
5343  inline int ic_age();
5344  inline void set_ic_age(int age);
5345
5346  // Add information on assignments of the form this.x = ...;
5347  void SetThisPropertyAssignmentsInfo(
5348      bool has_only_simple_this_property_assignments,
5349      FixedArray* this_property_assignments);
5350
5351  // Clear information on assignments of the form this.x = ...;
5352  void ClearThisPropertyAssignmentsInfo();
5353
5354  // Indicate that this function only consists of assignments of the form
5355  // this.x = y; where y is either a constant or refers to an argument.
5356  inline bool has_only_simple_this_property_assignments();
5357
5358  // Indicates if this function can be lazy compiled.
5359  // This is used to determine if we can safely flush code from a function
5360  // when doing GC if we expect that the function will no longer be used.
5361  DECL_BOOLEAN_ACCESSORS(allows_lazy_compilation)
5362
5363  // Indicates how many full GCs this function has survived with assigned
5364  // code object. Used to determine when it is relatively safe to flush
5365  // this code object and replace it with lazy compilation stub.
5366  // Age is reset when GC notices that the code object is referenced
5367  // from the stack or compilation cache.
5368  inline int code_age();
5369  inline void set_code_age(int age);
5370
5371  // Indicates whether optimizations have been disabled for this
5372  // shared function info. If a function is repeatedly optimized or if
5373  // we cannot optimize the function we disable optimization to avoid
5374  // spending time attempting to optimize it again.
5375  DECL_BOOLEAN_ACCESSORS(optimization_disabled)
5376
5377  // Indicates the language mode of the function's code as defined by the
5378  // current harmony drafts for the next ES language standard. Possible
5379  // values are:
5380  // 1. CLASSIC_MODE - Unrestricted syntax and semantics, same as in ES5.
5381  // 2. STRICT_MODE - Restricted syntax and semantics, same as in ES5.
5382  // 3. EXTENDED_MODE - Only available under the harmony flag, not part of ES5.
5383  inline LanguageMode language_mode();
5384  inline void set_language_mode(LanguageMode language_mode);
5385
5386  // Indicates whether the language mode of this function is CLASSIC_MODE.
5387  inline bool is_classic_mode();
5388
5389  // Indicates whether the language mode of this function is EXTENDED_MODE.
5390  inline bool is_extended_mode();
5391
5392  // False if the function definitely does not allocate an arguments object.
5393  DECL_BOOLEAN_ACCESSORS(uses_arguments)
5394
5395  // True if the function has any duplicated parameter names.
5396  DECL_BOOLEAN_ACCESSORS(has_duplicate_parameters)
5397
5398  // Indicates whether the function is a native function.
5399  // These needs special treatment in .call and .apply since
5400  // null passed as the receiver should not be translated to the
5401  // global object.
5402  DECL_BOOLEAN_ACCESSORS(native)
5403
5404  // Indicates that the function was created by the Function function.
5405  // Though it's anonymous, toString should treat it as if it had the name
5406  // "anonymous".  We don't set the name itself so that the system does not
5407  // see a binding for it.
5408  DECL_BOOLEAN_ACCESSORS(name_should_print_as_anonymous)
5409
5410  // Indicates whether the function is a bound function created using
5411  // the bind function.
5412  DECL_BOOLEAN_ACCESSORS(bound)
5413
5414  // Indicates that the function is anonymous (the name field can be set
5415  // through the API, which does not change this flag).
5416  DECL_BOOLEAN_ACCESSORS(is_anonymous)
5417
5418  // Is this a function or top-level/eval code.
5419  DECL_BOOLEAN_ACCESSORS(is_function)
5420
5421  // Indicates that the function cannot be optimized.
5422  DECL_BOOLEAN_ACCESSORS(dont_optimize)
5423
5424  // Indicates that the function cannot be inlined.
5425  DECL_BOOLEAN_ACCESSORS(dont_inline)
5426
5427  // Indicates whether or not the code in the shared function support
5428  // deoptimization.
5429  inline bool has_deoptimization_support();
5430
5431  // Enable deoptimization support through recompiled code.
5432  void EnableDeoptimizationSupport(Code* recompiled);
5433
5434  // Disable (further) attempted optimization of all functions sharing this
5435  // shared function info.
5436  void DisableOptimization();
5437
5438  // Lookup the bailout ID and ASSERT that it exists in the non-optimized
5439  // code, returns whether it asserted (i.e., always true if assertions are
5440  // disabled).
5441  bool VerifyBailoutId(int id);
5442
5443  // Check whether a inlined constructor can be generated with the given
5444  // prototype.
5445  bool CanGenerateInlineConstructor(Object* prototype);
5446
5447  // Prevents further attempts to generate inline constructors.
5448  // To be called if generation failed for any reason.
5449  void ForbidInlineConstructor();
5450
5451  // For functions which only contains this property assignments this provides
5452  // access to the names for the properties assigned.
5453  DECL_ACCESSORS(this_property_assignments, Object)
5454  inline int this_property_assignments_count();
5455  inline void set_this_property_assignments_count(int value);
5456  String* GetThisPropertyAssignmentName(int index);
5457  bool IsThisPropertyAssignmentArgument(int index);
5458  int GetThisPropertyAssignmentArgument(int index);
5459  Object* GetThisPropertyAssignmentConstant(int index);
5460
5461  // [source code]: Source code for the function.
5462  bool HasSourceCode();
5463  Handle<Object> GetSourceCode();
5464
5465  inline int opt_count();
5466  inline void set_opt_count(int opt_count);
5467
5468  // Source size of this function.
5469  int SourceSize();
5470
5471  // Calculate the instance size.
5472  int CalculateInstanceSize();
5473
5474  // Calculate the number of in-object properties.
5475  int CalculateInObjectProperties();
5476
5477  // Dispatched behavior.
5478  // Set max_length to -1 for unlimited length.
5479  void SourceCodePrint(StringStream* accumulator, int max_length);
5480#ifdef OBJECT_PRINT
5481  inline void SharedFunctionInfoPrint() {
5482    SharedFunctionInfoPrint(stdout);
5483  }
5484  void SharedFunctionInfoPrint(FILE* out);
5485#endif
5486#ifdef DEBUG
5487  void SharedFunctionInfoVerify();
5488#endif
5489
5490  void ResetForNewContext(int new_ic_age);
5491
5492  // Helpers to compile the shared code.  Returns true on success, false on
5493  // failure (e.g., stack overflow during compilation).
5494  static bool EnsureCompiled(Handle<SharedFunctionInfo> shared,
5495                             ClearExceptionFlag flag);
5496  static bool CompileLazy(Handle<SharedFunctionInfo> shared,
5497                          ClearExceptionFlag flag);
5498
5499  void SharedFunctionInfoIterateBody(ObjectVisitor* v);
5500
5501  // Casting.
5502  static inline SharedFunctionInfo* cast(Object* obj);
5503
5504  // Constants.
5505  static const int kDontAdaptArgumentsSentinel = -1;
5506
5507  // Layout description.
5508  // Pointer fields.
5509  static const int kNameOffset = HeapObject::kHeaderSize;
5510  static const int kCodeOffset = kNameOffset + kPointerSize;
5511  static const int kScopeInfoOffset = kCodeOffset + kPointerSize;
5512  static const int kConstructStubOffset = kScopeInfoOffset + kPointerSize;
5513  static const int kInstanceClassNameOffset =
5514      kConstructStubOffset + kPointerSize;
5515  static const int kFunctionDataOffset =
5516      kInstanceClassNameOffset + kPointerSize;
5517  static const int kScriptOffset = kFunctionDataOffset + kPointerSize;
5518  static const int kDebugInfoOffset = kScriptOffset + kPointerSize;
5519  static const int kInferredNameOffset = kDebugInfoOffset + kPointerSize;
5520  static const int kInitialMapOffset =
5521      kInferredNameOffset + kPointerSize;
5522  static const int kThisPropertyAssignmentsOffset =
5523      kInitialMapOffset + kPointerSize;
5524  // ic_age is a Smi field. It could be grouped with another Smi field into a
5525  // PSEUDO_SMI_ACCESSORS pair (on x64), if one becomes available.
5526  static const int kICAgeOffset = kThisPropertyAssignmentsOffset + kPointerSize;
5527#if V8_HOST_ARCH_32_BIT
5528  // Smi fields.
5529  static const int kLengthOffset =
5530      kICAgeOffset + kPointerSize;
5531  static const int kFormalParameterCountOffset = kLengthOffset + kPointerSize;
5532  static const int kExpectedNofPropertiesOffset =
5533      kFormalParameterCountOffset + kPointerSize;
5534  static const int kNumLiteralsOffset =
5535      kExpectedNofPropertiesOffset + kPointerSize;
5536  static const int kStartPositionAndTypeOffset =
5537      kNumLiteralsOffset + kPointerSize;
5538  static const int kEndPositionOffset =
5539      kStartPositionAndTypeOffset + kPointerSize;
5540  static const int kFunctionTokenPositionOffset =
5541      kEndPositionOffset + kPointerSize;
5542  static const int kCompilerHintsOffset =
5543      kFunctionTokenPositionOffset + kPointerSize;
5544  static const int kThisPropertyAssignmentsCountOffset =
5545      kCompilerHintsOffset + kPointerSize;
5546  static const int kOptCountOffset =
5547      kThisPropertyAssignmentsCountOffset + kPointerSize;
5548  static const int kAstNodeCountOffset = kOptCountOffset + kPointerSize;
5549  static const int kDeoptCounterOffset = kAstNodeCountOffset + kPointerSize;
5550
5551
5552  // Total size.
5553  static const int kSize = kDeoptCounterOffset + kPointerSize;
5554#else
5555  // The only reason to use smi fields instead of int fields
5556  // is to allow iteration without maps decoding during
5557  // garbage collections.
5558  // To avoid wasting space on 64-bit architectures we use
5559  // the following trick: we group integer fields into pairs
5560  // First integer in each pair is shifted left by 1.
5561  // By doing this we guarantee that LSB of each kPointerSize aligned
5562  // word is not set and thus this word cannot be treated as pointer
5563  // to HeapObject during old space traversal.
5564  static const int kLengthOffset =
5565      kICAgeOffset + kPointerSize;
5566  static const int kFormalParameterCountOffset =
5567      kLengthOffset + kIntSize;
5568
5569  static const int kExpectedNofPropertiesOffset =
5570      kFormalParameterCountOffset + kIntSize;
5571  static const int kNumLiteralsOffset =
5572      kExpectedNofPropertiesOffset + kIntSize;
5573
5574  static const int kEndPositionOffset =
5575      kNumLiteralsOffset + kIntSize;
5576  static const int kStartPositionAndTypeOffset =
5577      kEndPositionOffset + kIntSize;
5578
5579  static const int kFunctionTokenPositionOffset =
5580      kStartPositionAndTypeOffset + kIntSize;
5581  static const int kCompilerHintsOffset =
5582      kFunctionTokenPositionOffset + kIntSize;
5583
5584  static const int kThisPropertyAssignmentsCountOffset =
5585      kCompilerHintsOffset + kIntSize;
5586  static const int kOptCountOffset =
5587      kThisPropertyAssignmentsCountOffset + kIntSize;
5588
5589  static const int kAstNodeCountOffset = kOptCountOffset + kIntSize;
5590  static const int kDeoptCounterOffset = kAstNodeCountOffset + kIntSize;
5591
5592  // Total size.
5593  static const int kSize = kDeoptCounterOffset + kIntSize;
5594
5595#endif
5596
5597  // The construction counter for inobject slack tracking is stored in the
5598  // most significant byte of compiler_hints which is otherwise unused.
5599  // Its offset depends on the endian-ness of the architecture.
5600#if __BYTE_ORDER == __LITTLE_ENDIAN
5601  static const int kConstructionCountOffset = kCompilerHintsOffset + 3;
5602#elif __BYTE_ORDER == __BIG_ENDIAN
5603  static const int kConstructionCountOffset = kCompilerHintsOffset + 0;
5604#else
5605#error Unknown byte ordering
5606#endif
5607
5608  static const int kAlignedSize = POINTER_SIZE_ALIGN(kSize);
5609
5610  typedef FixedBodyDescriptor<kNameOffset,
5611                              kThisPropertyAssignmentsOffset + kPointerSize,
5612                              kSize> BodyDescriptor;
5613
5614  // Bit positions in start_position_and_type.
5615  // The source code start position is in the 30 most significant bits of
5616  // the start_position_and_type field.
5617  static const int kIsExpressionBit = 0;
5618  static const int kIsTopLevelBit   = 1;
5619  static const int kStartPositionShift = 2;
5620  static const int kStartPositionMask = ~((1 << kStartPositionShift) - 1);
5621
5622  // Bit positions in compiler_hints.
5623  static const int kCodeAgeSize = 3;
5624  static const int kCodeAgeMask = (1 << kCodeAgeSize) - 1;
5625
5626  enum CompilerHints {
5627    kHasOnlySimpleThisPropertyAssignments,
5628    kAllowLazyCompilation,
5629    kLiveObjectsMayExist,
5630    kCodeAgeShift,
5631    kOptimizationDisabled = kCodeAgeShift + kCodeAgeSize,
5632    kStrictModeFunction,
5633    kExtendedModeFunction,
5634    kUsesArguments,
5635    kHasDuplicateParameters,
5636    kNative,
5637    kBoundFunction,
5638    kIsAnonymous,
5639    kNameShouldPrintAsAnonymous,
5640    kIsFunction,
5641    kDontOptimize,
5642    kDontInline,
5643    kCompilerHintsCount  // Pseudo entry
5644  };
5645
5646 private:
5647#if V8_HOST_ARCH_32_BIT
5648  // On 32 bit platforms, compiler hints is a smi.
5649  static const int kCompilerHintsSmiTagSize = kSmiTagSize;
5650  static const int kCompilerHintsSize = kPointerSize;
5651#else
5652  // On 64 bit platforms, compiler hints is not a smi, see comment above.
5653  static const int kCompilerHintsSmiTagSize = 0;
5654  static const int kCompilerHintsSize = kIntSize;
5655#endif
5656
5657  STATIC_ASSERT(SharedFunctionInfo::kCompilerHintsCount <=
5658                SharedFunctionInfo::kCompilerHintsSize * kBitsPerByte);
5659
5660 public:
5661  // Constants for optimizing codegen for strict mode function and
5662  // native tests.
5663  // Allows to use byte-width instructions.
5664  static const int kStrictModeBitWithinByte =
5665      (kStrictModeFunction + kCompilerHintsSmiTagSize) % kBitsPerByte;
5666
5667  static const int kExtendedModeBitWithinByte =
5668      (kExtendedModeFunction + kCompilerHintsSmiTagSize) % kBitsPerByte;
5669
5670  static const int kNativeBitWithinByte =
5671      (kNative + kCompilerHintsSmiTagSize) % kBitsPerByte;
5672
5673#if __BYTE_ORDER == __LITTLE_ENDIAN
5674  static const int kStrictModeByteOffset = kCompilerHintsOffset +
5675      (kStrictModeFunction + kCompilerHintsSmiTagSize) / kBitsPerByte;
5676  static const int kExtendedModeByteOffset = kCompilerHintsOffset +
5677      (kExtendedModeFunction + kCompilerHintsSmiTagSize) / kBitsPerByte;
5678  static const int kNativeByteOffset = kCompilerHintsOffset +
5679      (kNative + kCompilerHintsSmiTagSize) / kBitsPerByte;
5680#elif __BYTE_ORDER == __BIG_ENDIAN
5681  static const int kStrictModeByteOffset = kCompilerHintsOffset +
5682      (kCompilerHintsSize - 1) -
5683      ((kStrictModeFunction + kCompilerHintsSmiTagSize) / kBitsPerByte);
5684  static const int kExtendedModeByteOffset = kCompilerHintsOffset +
5685      (kCompilerHintsSize - 1) -
5686      ((kExtendedModeFunction + kCompilerHintsSmiTagSize) / kBitsPerByte);
5687  static const int kNativeByteOffset = kCompilerHintsOffset +
5688      (kCompilerHintsSize - 1) -
5689      ((kNative + kCompilerHintsSmiTagSize) / kBitsPerByte);
5690#else
5691#error Unknown byte ordering
5692#endif
5693
5694 private:
5695  DISALLOW_IMPLICIT_CONSTRUCTORS(SharedFunctionInfo);
5696};
5697
5698
5699// JSFunction describes JavaScript functions.
5700class JSFunction: public JSObject {
5701 public:
5702  // [prototype_or_initial_map]:
5703  DECL_ACCESSORS(prototype_or_initial_map, Object)
5704
5705  // [shared]: The information about the function that
5706  // can be shared by instances.
5707  DECL_ACCESSORS(shared, SharedFunctionInfo)
5708
5709  inline SharedFunctionInfo* unchecked_shared();
5710
5711  // [context]: The context for this function.
5712  inline Context* context();
5713  inline Object* unchecked_context();
5714  inline void set_context(Object* context);
5715
5716  // [code]: The generated code object for this function.  Executed
5717  // when the function is invoked, e.g. foo() or new foo(). See
5718  // [[Call]] and [[Construct]] description in ECMA-262, section
5719  // 8.6.2, page 27.
5720  inline Code* code();
5721  inline void set_code(Code* code);
5722  inline void ReplaceCode(Code* code);
5723
5724  inline Code* unchecked_code();
5725
5726  // Tells whether this function is builtin.
5727  inline bool IsBuiltin();
5728
5729  // Tells whether or not the function needs arguments adaption.
5730  inline bool NeedsArgumentsAdaption();
5731
5732  // Tells whether or not this function has been optimized.
5733  inline bool IsOptimized();
5734
5735  // Tells whether or not this function can be optimized.
5736  inline bool IsOptimizable();
5737
5738  // Mark this function for lazy recompilation. The function will be
5739  // recompiled the next time it is executed.
5740  void MarkForLazyRecompilation();
5741
5742  // Helpers to compile this function.  Returns true on success, false on
5743  // failure (e.g., stack overflow during compilation).
5744  static bool CompileLazy(Handle<JSFunction> function,
5745                          ClearExceptionFlag flag);
5746  static bool CompileOptimized(Handle<JSFunction> function,
5747                               int osr_ast_id,
5748                               ClearExceptionFlag flag);
5749
5750  // Tells whether or not the function is already marked for lazy
5751  // recompilation.
5752  inline bool IsMarkedForLazyRecompilation();
5753
5754  // Check whether or not this function is inlineable.
5755  bool IsInlineable();
5756
5757  // [literals_or_bindings]: Fixed array holding either
5758  // the materialized literals or the bindings of a bound function.
5759  //
5760  // If the function contains object, regexp or array literals, the
5761  // literals array prefix contains the object, regexp, and array
5762  // function to be used when creating these literals.  This is
5763  // necessary so that we do not dynamically lookup the object, regexp
5764  // or array functions.  Performing a dynamic lookup, we might end up
5765  // using the functions from a new context that we should not have
5766  // access to.
5767  //
5768  // On bound functions, the array is a (copy-on-write) fixed-array containing
5769  // the function that was bound, bound this-value and any bound
5770  // arguments. Bound functions never contain literals.
5771  DECL_ACCESSORS(literals_or_bindings, FixedArray)
5772
5773  inline FixedArray* literals();
5774  inline void set_literals(FixedArray* literals);
5775
5776  inline FixedArray* function_bindings();
5777  inline void set_function_bindings(FixedArray* bindings);
5778
5779  // The initial map for an object created by this constructor.
5780  inline Map* initial_map();
5781  inline void set_initial_map(Map* value);
5782  MUST_USE_RESULT inline MaybeObject* set_initial_map_and_cache_transitions(
5783      Map* value);
5784  inline bool has_initial_map();
5785
5786  // Get and set the prototype property on a JSFunction. If the
5787  // function has an initial map the prototype is set on the initial
5788  // map. Otherwise, the prototype is put in the initial map field
5789  // until an initial map is needed.
5790  inline bool has_prototype();
5791  inline bool has_instance_prototype();
5792  inline Object* prototype();
5793  inline Object* instance_prototype();
5794  MUST_USE_RESULT MaybeObject* SetInstancePrototype(Object* value);
5795  MUST_USE_RESULT MaybeObject* SetPrototype(Object* value);
5796
5797  // After prototype is removed, it will not be created when accessed, and
5798  // [[Construct]] from this function will not be allowed.
5799  Object* RemovePrototype();
5800  inline bool should_have_prototype();
5801
5802  // Accessor for this function's initial map's [[class]]
5803  // property. This is primarily used by ECMA native functions.  This
5804  // method sets the class_name field of this function's initial map
5805  // to a given value. It creates an initial map if this function does
5806  // not have one. Note that this method does not copy the initial map
5807  // if it has one already, but simply replaces it with the new value.
5808  // Instances created afterwards will have a map whose [[class]] is
5809  // set to 'value', but there is no guarantees on instances created
5810  // before.
5811  Object* SetInstanceClassName(String* name);
5812
5813  // Returns if this function has been compiled to native code yet.
5814  inline bool is_compiled();
5815
5816  // [next_function_link]: Field for linking functions. This list is treated as
5817  // a weak list by the GC.
5818  DECL_ACCESSORS(next_function_link, Object)
5819
5820  // Prints the name of the function using PrintF.
5821  inline void PrintName() {
5822    PrintName(stdout);
5823  }
5824  void PrintName(FILE* out);
5825
5826  // Casting.
5827  static inline JSFunction* cast(Object* obj);
5828
5829  // Iterates the objects, including code objects indirectly referenced
5830  // through pointers to the first instruction in the code object.
5831  void JSFunctionIterateBody(int object_size, ObjectVisitor* v);
5832
5833  // Dispatched behavior.
5834#ifdef OBJECT_PRINT
5835  inline void JSFunctionPrint() {
5836    JSFunctionPrint(stdout);
5837  }
5838  void JSFunctionPrint(FILE* out);
5839#endif
5840#ifdef DEBUG
5841  void JSFunctionVerify();
5842#endif
5843
5844  // Returns the number of allocated literals.
5845  inline int NumberOfLiterals();
5846
5847  // Retrieve the global context from a function's literal array.
5848  static Context* GlobalContextFromLiterals(FixedArray* literals);
5849
5850  // Layout descriptors. The last property (from kNonWeakFieldsEndOffset to
5851  // kSize) is weak and has special handling during garbage collection.
5852  static const int kCodeEntryOffset = JSObject::kHeaderSize;
5853  static const int kPrototypeOrInitialMapOffset =
5854      kCodeEntryOffset + kPointerSize;
5855  static const int kSharedFunctionInfoOffset =
5856      kPrototypeOrInitialMapOffset + kPointerSize;
5857  static const int kContextOffset = kSharedFunctionInfoOffset + kPointerSize;
5858  static const int kLiteralsOffset = kContextOffset + kPointerSize;
5859  static const int kNonWeakFieldsEndOffset = kLiteralsOffset + kPointerSize;
5860  static const int kNextFunctionLinkOffset = kNonWeakFieldsEndOffset;
5861  static const int kSize = kNextFunctionLinkOffset + kPointerSize;
5862
5863  // Layout of the literals array.
5864  static const int kLiteralsPrefixSize = 1;
5865  static const int kLiteralGlobalContextIndex = 0;
5866
5867  // Layout of the bound-function binding array.
5868  static const int kBoundFunctionIndex = 0;
5869  static const int kBoundThisIndex = 1;
5870  static const int kBoundArgumentsStartIndex = 2;
5871
5872 private:
5873  DISALLOW_IMPLICIT_CONSTRUCTORS(JSFunction);
5874};
5875
5876
5877// JSGlobalProxy's prototype must be a JSGlobalObject or null,
5878// and the prototype is hidden. JSGlobalProxy always delegates
5879// property accesses to its prototype if the prototype is not null.
5880//
5881// A JSGlobalProxy can be reinitialized which will preserve its identity.
5882//
5883// Accessing a JSGlobalProxy requires security check.
5884
5885class JSGlobalProxy : public JSObject {
5886 public:
5887  // [context]: the owner global context of this global proxy object.
5888  // It is null value if this object is not used by any context.
5889  DECL_ACCESSORS(context, Object)
5890
5891  // Casting.
5892  static inline JSGlobalProxy* cast(Object* obj);
5893
5894  // Dispatched behavior.
5895#ifdef OBJECT_PRINT
5896  inline void JSGlobalProxyPrint() {
5897    JSGlobalProxyPrint(stdout);
5898  }
5899  void JSGlobalProxyPrint(FILE* out);
5900#endif
5901#ifdef DEBUG
5902  void JSGlobalProxyVerify();
5903#endif
5904
5905  // Layout description.
5906  static const int kContextOffset = JSObject::kHeaderSize;
5907  static const int kSize = kContextOffset + kPointerSize;
5908
5909 private:
5910  DISALLOW_IMPLICIT_CONSTRUCTORS(JSGlobalProxy);
5911};
5912
5913
5914// Forward declaration.
5915class JSBuiltinsObject;
5916
5917// Common super class for JavaScript global objects and the special
5918// builtins global objects.
5919class GlobalObject: public JSObject {
5920 public:
5921  // [builtins]: the object holding the runtime routines written in JS.
5922  DECL_ACCESSORS(builtins, JSBuiltinsObject)
5923
5924  // [global context]: the global context corresponding to this global object.
5925  DECL_ACCESSORS(global_context, Context)
5926
5927  // [global receiver]: the global receiver object of the context
5928  DECL_ACCESSORS(global_receiver, JSObject)
5929
5930  // Retrieve the property cell used to store a property.
5931  JSGlobalPropertyCell* GetPropertyCell(LookupResult* result);
5932
5933  // This is like GetProperty, but is used when you know the lookup won't fail
5934  // by throwing an exception.  This is for the debug and builtins global
5935  // objects, where it is known which properties can be expected to be present
5936  // on the object.
5937  Object* GetPropertyNoExceptionThrown(String* key) {
5938    Object* answer = GetProperty(key)->ToObjectUnchecked();
5939    return answer;
5940  }
5941
5942  // Ensure that the global object has a cell for the given property name.
5943  static Handle<JSGlobalPropertyCell> EnsurePropertyCell(
5944      Handle<GlobalObject> global,
5945      Handle<String> name);
5946  // TODO(kmillikin): This function can be eliminated once the stub cache is
5947  // full handlified (and the static helper can be written directly).
5948  MUST_USE_RESULT MaybeObject* EnsurePropertyCell(String* name);
5949
5950  // Casting.
5951  static inline GlobalObject* cast(Object* obj);
5952
5953  // Layout description.
5954  static const int kBuiltinsOffset = JSObject::kHeaderSize;
5955  static const int kGlobalContextOffset = kBuiltinsOffset + kPointerSize;
5956  static const int kGlobalReceiverOffset = kGlobalContextOffset + kPointerSize;
5957  static const int kHeaderSize = kGlobalReceiverOffset + kPointerSize;
5958
5959 private:
5960  DISALLOW_IMPLICIT_CONSTRUCTORS(GlobalObject);
5961};
5962
5963
5964// JavaScript global object.
5965class JSGlobalObject: public GlobalObject {
5966 public:
5967  // Casting.
5968  static inline JSGlobalObject* cast(Object* obj);
5969
5970  // Dispatched behavior.
5971#ifdef OBJECT_PRINT
5972  inline void JSGlobalObjectPrint() {
5973    JSGlobalObjectPrint(stdout);
5974  }
5975  void JSGlobalObjectPrint(FILE* out);
5976#endif
5977#ifdef DEBUG
5978  void JSGlobalObjectVerify();
5979#endif
5980
5981  // Layout description.
5982  static const int kSize = GlobalObject::kHeaderSize;
5983
5984 private:
5985  DISALLOW_IMPLICIT_CONSTRUCTORS(JSGlobalObject);
5986};
5987
5988
5989// Builtins global object which holds the runtime routines written in
5990// JavaScript.
5991class JSBuiltinsObject: public GlobalObject {
5992 public:
5993  // Accessors for the runtime routines written in JavaScript.
5994  inline Object* javascript_builtin(Builtins::JavaScript id);
5995  inline void set_javascript_builtin(Builtins::JavaScript id, Object* value);
5996
5997  // Accessors for code of the runtime routines written in JavaScript.
5998  inline Code* javascript_builtin_code(Builtins::JavaScript id);
5999  inline void set_javascript_builtin_code(Builtins::JavaScript id, Code* value);
6000
6001  // Casting.
6002  static inline JSBuiltinsObject* cast(Object* obj);
6003
6004  // Dispatched behavior.
6005#ifdef OBJECT_PRINT
6006  inline void JSBuiltinsObjectPrint() {
6007    JSBuiltinsObjectPrint(stdout);
6008  }
6009  void JSBuiltinsObjectPrint(FILE* out);
6010#endif
6011#ifdef DEBUG
6012  void JSBuiltinsObjectVerify();
6013#endif
6014
6015  // Layout description.  The size of the builtins object includes
6016  // room for two pointers per runtime routine written in javascript
6017  // (function and code object).
6018  static const int kJSBuiltinsCount = Builtins::id_count;
6019  static const int kJSBuiltinsOffset = GlobalObject::kHeaderSize;
6020  static const int kJSBuiltinsCodeOffset =
6021      GlobalObject::kHeaderSize + (kJSBuiltinsCount * kPointerSize);
6022  static const int kSize =
6023      kJSBuiltinsCodeOffset + (kJSBuiltinsCount * kPointerSize);
6024
6025  static int OffsetOfFunctionWithId(Builtins::JavaScript id) {
6026    return kJSBuiltinsOffset + id * kPointerSize;
6027  }
6028
6029  static int OffsetOfCodeWithId(Builtins::JavaScript id) {
6030    return kJSBuiltinsCodeOffset + id * kPointerSize;
6031  }
6032
6033 private:
6034  DISALLOW_IMPLICIT_CONSTRUCTORS(JSBuiltinsObject);
6035};
6036
6037
6038// Representation for JS Wrapper objects, String, Number, Boolean, etc.
6039class JSValue: public JSObject {
6040 public:
6041  // [value]: the object being wrapped.
6042  DECL_ACCESSORS(value, Object)
6043
6044  // Casting.
6045  static inline JSValue* cast(Object* obj);
6046
6047  // Dispatched behavior.
6048#ifdef OBJECT_PRINT
6049  inline void JSValuePrint() {
6050    JSValuePrint(stdout);
6051  }
6052  void JSValuePrint(FILE* out);
6053#endif
6054#ifdef DEBUG
6055  void JSValueVerify();
6056#endif
6057
6058  // Layout description.
6059  static const int kValueOffset = JSObject::kHeaderSize;
6060  static const int kSize = kValueOffset + kPointerSize;
6061
6062 private:
6063  DISALLOW_IMPLICIT_CONSTRUCTORS(JSValue);
6064};
6065
6066
6067class DateCache;
6068
6069// Representation for JS date objects.
6070class JSDate: public JSObject {
6071 public:
6072  // If one component is NaN, all of them are, indicating a NaN time value.
6073  // [value]: the time value.
6074  DECL_ACCESSORS(value, Object)
6075  // [year]: caches year. Either undefined, smi, or NaN.
6076  DECL_ACCESSORS(year, Object)
6077  // [month]: caches month. Either undefined, smi, or NaN.
6078  DECL_ACCESSORS(month, Object)
6079  // [day]: caches day. Either undefined, smi, or NaN.
6080  DECL_ACCESSORS(day, Object)
6081  // [weekday]: caches day of week. Either undefined, smi, or NaN.
6082  DECL_ACCESSORS(weekday, Object)
6083  // [hour]: caches hours. Either undefined, smi, or NaN.
6084  DECL_ACCESSORS(hour, Object)
6085  // [min]: caches minutes. Either undefined, smi, or NaN.
6086  DECL_ACCESSORS(min, Object)
6087  // [sec]: caches seconds. Either undefined, smi, or NaN.
6088  DECL_ACCESSORS(sec, Object)
6089  // [cache stamp]: sample of the date cache stamp at the
6090  // moment when local fields were cached.
6091  DECL_ACCESSORS(cache_stamp, Object)
6092
6093  // Casting.
6094  static inline JSDate* cast(Object* obj);
6095
6096  // Returns the date field with the specified index.
6097  // See FieldIndex for the list of date fields.
6098  static MaybeObject* GetField(Object* date, Smi* index);
6099
6100  void SetValue(Object* value, bool is_value_nan);
6101
6102
6103  // Dispatched behavior.
6104#ifdef OBJECT_PRINT
6105  inline void JSDatePrint() {
6106    JSDatePrint(stdout);
6107  }
6108  void JSDatePrint(FILE* out);
6109#endif
6110#ifdef DEBUG
6111  void JSDateVerify();
6112#endif
6113  // The order is important. It must be kept in sync with date macros
6114  // in macros.py.
6115  enum FieldIndex {
6116    kDateValue,
6117    kYear,
6118    kMonth,
6119    kDay,
6120    kWeekday,
6121    kHour,
6122    kMinute,
6123    kSecond,
6124    kFirstUncachedField,
6125    kMillisecond = kFirstUncachedField,
6126    kDays,
6127    kTimeInDay,
6128    kFirstUTCField,
6129    kYearUTC = kFirstUTCField,
6130    kMonthUTC,
6131    kDayUTC,
6132    kWeekdayUTC,
6133    kHourUTC,
6134    kMinuteUTC,
6135    kSecondUTC,
6136    kMillisecondUTC,
6137    kDaysUTC,
6138    kTimeInDayUTC,
6139    kTimezoneOffset
6140  };
6141
6142  // Layout description.
6143  static const int kValueOffset = JSObject::kHeaderSize;
6144  static const int kYearOffset = kValueOffset + kPointerSize;
6145  static const int kMonthOffset = kYearOffset + kPointerSize;
6146  static const int kDayOffset = kMonthOffset + kPointerSize;
6147  static const int kWeekdayOffset = kDayOffset + kPointerSize;
6148  static const int kHourOffset = kWeekdayOffset  + kPointerSize;
6149  static const int kMinOffset = kHourOffset + kPointerSize;
6150  static const int kSecOffset = kMinOffset + kPointerSize;
6151  static const int kCacheStampOffset = kSecOffset + kPointerSize;
6152  static const int kSize = kCacheStampOffset + kPointerSize;
6153
6154 private:
6155  inline Object* DoGetField(FieldIndex index);
6156
6157  Object* GetUTCField(FieldIndex index, double value, DateCache* date_cache);
6158
6159  // Computes and caches the cacheable fields of the date.
6160  inline void SetLocalFields(int64_t local_time_ms, DateCache* date_cache);
6161
6162
6163  DISALLOW_IMPLICIT_CONSTRUCTORS(JSDate);
6164};
6165
6166
6167// Representation of message objects used for error reporting through
6168// the API. The messages are formatted in JavaScript so this object is
6169// a real JavaScript object. The information used for formatting the
6170// error messages are not directly accessible from JavaScript to
6171// prevent leaking information to user code called during error
6172// formatting.
6173class JSMessageObject: public JSObject {
6174 public:
6175  // [type]: the type of error message.
6176  DECL_ACCESSORS(type, String)
6177
6178  // [arguments]: the arguments for formatting the error message.
6179  DECL_ACCESSORS(arguments, JSArray)
6180
6181  // [script]: the script from which the error message originated.
6182  DECL_ACCESSORS(script, Object)
6183
6184  // [stack_trace]: the stack trace for this error message.
6185  DECL_ACCESSORS(stack_trace, Object)
6186
6187  // [stack_frames]: an array of stack frames for this error object.
6188  DECL_ACCESSORS(stack_frames, Object)
6189
6190  // [start_position]: the start position in the script for the error message.
6191  inline int start_position();
6192  inline void set_start_position(int value);
6193
6194  // [end_position]: the end position in the script for the error message.
6195  inline int end_position();
6196  inline void set_end_position(int value);
6197
6198  // Casting.
6199  static inline JSMessageObject* cast(Object* obj);
6200
6201  // Dispatched behavior.
6202#ifdef OBJECT_PRINT
6203  inline void JSMessageObjectPrint() {
6204    JSMessageObjectPrint(stdout);
6205  }
6206  void JSMessageObjectPrint(FILE* out);
6207#endif
6208#ifdef DEBUG
6209  void JSMessageObjectVerify();
6210#endif
6211
6212  // Layout description.
6213  static const int kTypeOffset = JSObject::kHeaderSize;
6214  static const int kArgumentsOffset = kTypeOffset + kPointerSize;
6215  static const int kScriptOffset = kArgumentsOffset + kPointerSize;
6216  static const int kStackTraceOffset = kScriptOffset + kPointerSize;
6217  static const int kStackFramesOffset = kStackTraceOffset + kPointerSize;
6218  static const int kStartPositionOffset = kStackFramesOffset + kPointerSize;
6219  static const int kEndPositionOffset = kStartPositionOffset + kPointerSize;
6220  static const int kSize = kEndPositionOffset + kPointerSize;
6221
6222  typedef FixedBodyDescriptor<HeapObject::kMapOffset,
6223                              kStackFramesOffset + kPointerSize,
6224                              kSize> BodyDescriptor;
6225};
6226
6227
6228// Regular expressions
6229// The regular expression holds a single reference to a FixedArray in
6230// the kDataOffset field.
6231// The FixedArray contains the following data:
6232// - tag : type of regexp implementation (not compiled yet, atom or irregexp)
6233// - reference to the original source string
6234// - reference to the original flag string
6235// If it is an atom regexp
6236// - a reference to a literal string to search for
6237// If it is an irregexp regexp:
6238// - a reference to code for ASCII inputs (bytecode or compiled), or a smi
6239// used for tracking the last usage (used for code flushing).
6240// - a reference to code for UC16 inputs (bytecode or compiled), or a smi
6241// used for tracking the last usage (used for code flushing)..
6242// - max number of registers used by irregexp implementations.
6243// - number of capture registers (output values) of the regexp.
6244class JSRegExp: public JSObject {
6245 public:
6246  // Meaning of Type:
6247  // NOT_COMPILED: Initial value. No data has been stored in the JSRegExp yet.
6248  // ATOM: A simple string to match against using an indexOf operation.
6249  // IRREGEXP: Compiled with Irregexp.
6250  // IRREGEXP_NATIVE: Compiled to native code with Irregexp.
6251  enum Type { NOT_COMPILED, ATOM, IRREGEXP };
6252  enum Flag { NONE = 0, GLOBAL = 1, IGNORE_CASE = 2, MULTILINE = 4 };
6253
6254  class Flags {
6255   public:
6256    explicit Flags(uint32_t value) : value_(value) { }
6257    bool is_global() { return (value_ & GLOBAL) != 0; }
6258    bool is_ignore_case() { return (value_ & IGNORE_CASE) != 0; }
6259    bool is_multiline() { return (value_ & MULTILINE) != 0; }
6260    uint32_t value() { return value_; }
6261   private:
6262    uint32_t value_;
6263  };
6264
6265  DECL_ACCESSORS(data, Object)
6266
6267  inline Type TypeTag();
6268  inline int CaptureCount();
6269  inline Flags GetFlags();
6270  inline String* Pattern();
6271  inline Object* DataAt(int index);
6272  // Set implementation data after the object has been prepared.
6273  inline void SetDataAt(int index, Object* value);
6274
6275  // Used during GC when flushing code or setting age.
6276  inline Object* DataAtUnchecked(int index);
6277  inline void SetDataAtUnchecked(int index, Object* value, Heap* heap);
6278  inline Type TypeTagUnchecked();
6279
6280  static int code_index(bool is_ascii) {
6281    if (is_ascii) {
6282      return kIrregexpASCIICodeIndex;
6283    } else {
6284      return kIrregexpUC16CodeIndex;
6285    }
6286  }
6287
6288  static int saved_code_index(bool is_ascii) {
6289    if (is_ascii) {
6290      return kIrregexpASCIICodeSavedIndex;
6291    } else {
6292      return kIrregexpUC16CodeSavedIndex;
6293    }
6294  }
6295
6296  static inline JSRegExp* cast(Object* obj);
6297
6298  // Dispatched behavior.
6299#ifdef DEBUG
6300  void JSRegExpVerify();
6301#endif
6302
6303  static const int kDataOffset = JSObject::kHeaderSize;
6304  static const int kSize = kDataOffset + kPointerSize;
6305
6306  // Indices in the data array.
6307  static const int kTagIndex = 0;
6308  static const int kSourceIndex = kTagIndex + 1;
6309  static const int kFlagsIndex = kSourceIndex + 1;
6310  static const int kDataIndex = kFlagsIndex + 1;
6311  // The data fields are used in different ways depending on the
6312  // value of the tag.
6313  // Atom regexps (literal strings).
6314  static const int kAtomPatternIndex = kDataIndex;
6315
6316  static const int kAtomDataSize = kAtomPatternIndex + 1;
6317
6318  // Irregexp compiled code or bytecode for ASCII. If compilation
6319  // fails, this fields hold an exception object that should be
6320  // thrown if the regexp is used again.
6321  static const int kIrregexpASCIICodeIndex = kDataIndex;
6322  // Irregexp compiled code or bytecode for UC16.  If compilation
6323  // fails, this fields hold an exception object that should be
6324  // thrown if the regexp is used again.
6325  static const int kIrregexpUC16CodeIndex = kDataIndex + 1;
6326
6327  // Saved instance of Irregexp compiled code or bytecode for ASCII that
6328  // is a potential candidate for flushing.
6329  static const int kIrregexpASCIICodeSavedIndex = kDataIndex + 2;
6330  // Saved instance of Irregexp compiled code or bytecode for UC16 that is
6331  // a potential candidate for flushing.
6332  static const int kIrregexpUC16CodeSavedIndex = kDataIndex + 3;
6333
6334  // Maximal number of registers used by either ASCII or UC16.
6335  // Only used to check that there is enough stack space
6336  static const int kIrregexpMaxRegisterCountIndex = kDataIndex + 4;
6337  // Number of captures in the compiled regexp.
6338  static const int kIrregexpCaptureCountIndex = kDataIndex + 5;
6339
6340  static const int kIrregexpDataSize = kIrregexpCaptureCountIndex + 1;
6341
6342  // Offsets directly into the data fixed array.
6343  static const int kDataTagOffset =
6344      FixedArray::kHeaderSize + kTagIndex * kPointerSize;
6345  static const int kDataAsciiCodeOffset =
6346      FixedArray::kHeaderSize + kIrregexpASCIICodeIndex * kPointerSize;
6347  static const int kDataUC16CodeOffset =
6348      FixedArray::kHeaderSize + kIrregexpUC16CodeIndex * kPointerSize;
6349  static const int kIrregexpCaptureCountOffset =
6350      FixedArray::kHeaderSize + kIrregexpCaptureCountIndex * kPointerSize;
6351
6352  // In-object fields.
6353  static const int kSourceFieldIndex = 0;
6354  static const int kGlobalFieldIndex = 1;
6355  static const int kIgnoreCaseFieldIndex = 2;
6356  static const int kMultilineFieldIndex = 3;
6357  static const int kLastIndexFieldIndex = 4;
6358  static const int kInObjectFieldCount = 5;
6359
6360  // The uninitialized value for a regexp code object.
6361  static const int kUninitializedValue = -1;
6362
6363  // The compilation error value for the regexp code object. The real error
6364  // object is in the saved code field.
6365  static const int kCompilationErrorValue = -2;
6366
6367  // When we store the sweep generation at which we moved the code from the
6368  // code index to the saved code index we mask it of to be in the [0:255]
6369  // range.
6370  static const int kCodeAgeMask = 0xff;
6371};
6372
6373
6374class CompilationCacheShape : public BaseShape<HashTableKey*> {
6375 public:
6376  static inline bool IsMatch(HashTableKey* key, Object* value) {
6377    return key->IsMatch(value);
6378  }
6379
6380  static inline uint32_t Hash(HashTableKey* key) {
6381    return key->Hash();
6382  }
6383
6384  static inline uint32_t HashForObject(HashTableKey* key, Object* object) {
6385    return key->HashForObject(object);
6386  }
6387
6388  MUST_USE_RESULT static MaybeObject* AsObject(HashTableKey* key) {
6389    return key->AsObject();
6390  }
6391
6392  static const int kPrefixSize = 0;
6393  static const int kEntrySize = 2;
6394};
6395
6396
6397class CompilationCacheTable: public HashTable<CompilationCacheShape,
6398                                              HashTableKey*> {
6399 public:
6400  // Find cached value for a string key, otherwise return null.
6401  Object* Lookup(String* src);
6402  Object* LookupEval(String* src,
6403                     Context* context,
6404                     LanguageMode language_mode,
6405                     int scope_position);
6406  Object* LookupRegExp(String* source, JSRegExp::Flags flags);
6407  MUST_USE_RESULT MaybeObject* Put(String* src, Object* value);
6408  MUST_USE_RESULT MaybeObject* PutEval(String* src,
6409                                       Context* context,
6410                                       SharedFunctionInfo* value,
6411                                       int scope_position);
6412  MUST_USE_RESULT MaybeObject* PutRegExp(String* src,
6413                                         JSRegExp::Flags flags,
6414                                         FixedArray* value);
6415
6416  // Remove given value from cache.
6417  void Remove(Object* value);
6418
6419  static inline CompilationCacheTable* cast(Object* obj);
6420
6421 private:
6422  DISALLOW_IMPLICIT_CONSTRUCTORS(CompilationCacheTable);
6423};
6424
6425
6426class CodeCache: public Struct {
6427 public:
6428  DECL_ACCESSORS(default_cache, FixedArray)
6429  DECL_ACCESSORS(normal_type_cache, Object)
6430
6431  // Add the code object to the cache.
6432  MUST_USE_RESULT MaybeObject* Update(String* name, Code* code);
6433
6434  // Lookup code object in the cache. Returns code object if found and undefined
6435  // if not.
6436  Object* Lookup(String* name, Code::Flags flags);
6437
6438  // Get the internal index of a code object in the cache. Returns -1 if the
6439  // code object is not in that cache. This index can be used to later call
6440  // RemoveByIndex. The cache cannot be modified between a call to GetIndex and
6441  // RemoveByIndex.
6442  int GetIndex(Object* name, Code* code);
6443
6444  // Remove an object from the cache with the provided internal index.
6445  void RemoveByIndex(Object* name, Code* code, int index);
6446
6447  static inline CodeCache* cast(Object* obj);
6448
6449#ifdef OBJECT_PRINT
6450  inline void CodeCachePrint() {
6451    CodeCachePrint(stdout);
6452  }
6453  void CodeCachePrint(FILE* out);
6454#endif
6455#ifdef DEBUG
6456  void CodeCacheVerify();
6457#endif
6458
6459  static const int kDefaultCacheOffset = HeapObject::kHeaderSize;
6460  static const int kNormalTypeCacheOffset =
6461      kDefaultCacheOffset + kPointerSize;
6462  static const int kSize = kNormalTypeCacheOffset + kPointerSize;
6463
6464 private:
6465  MUST_USE_RESULT MaybeObject* UpdateDefaultCache(String* name, Code* code);
6466  MUST_USE_RESULT MaybeObject* UpdateNormalTypeCache(String* name, Code* code);
6467  Object* LookupDefaultCache(String* name, Code::Flags flags);
6468  Object* LookupNormalTypeCache(String* name, Code::Flags flags);
6469
6470  // Code cache layout of the default cache. Elements are alternating name and
6471  // code objects for non normal load/store/call IC's.
6472  static const int kCodeCacheEntrySize = 2;
6473  static const int kCodeCacheEntryNameOffset = 0;
6474  static const int kCodeCacheEntryCodeOffset = 1;
6475
6476  DISALLOW_IMPLICIT_CONSTRUCTORS(CodeCache);
6477};
6478
6479
6480class CodeCacheHashTableShape : public BaseShape<HashTableKey*> {
6481 public:
6482  static inline bool IsMatch(HashTableKey* key, Object* value) {
6483    return key->IsMatch(value);
6484  }
6485
6486  static inline uint32_t Hash(HashTableKey* key) {
6487    return key->Hash();
6488  }
6489
6490  static inline uint32_t HashForObject(HashTableKey* key, Object* object) {
6491    return key->HashForObject(object);
6492  }
6493
6494  MUST_USE_RESULT static MaybeObject* AsObject(HashTableKey* key) {
6495    return key->AsObject();
6496  }
6497
6498  static const int kPrefixSize = 0;
6499  static const int kEntrySize = 2;
6500};
6501
6502
6503class CodeCacheHashTable: public HashTable<CodeCacheHashTableShape,
6504                                           HashTableKey*> {
6505 public:
6506  Object* Lookup(String* name, Code::Flags flags);
6507  MUST_USE_RESULT MaybeObject* Put(String* name, Code* code);
6508
6509  int GetIndex(String* name, Code::Flags flags);
6510  void RemoveByIndex(int index);
6511
6512  static inline CodeCacheHashTable* cast(Object* obj);
6513
6514  // Initial size of the fixed array backing the hash table.
6515  static const int kInitialSize = 64;
6516
6517 private:
6518  DISALLOW_IMPLICIT_CONSTRUCTORS(CodeCacheHashTable);
6519};
6520
6521
6522class PolymorphicCodeCache: public Struct {
6523 public:
6524  DECL_ACCESSORS(cache, Object)
6525
6526  static void Update(Handle<PolymorphicCodeCache> cache,
6527                     MapHandleList* maps,
6528                     Code::Flags flags,
6529                     Handle<Code> code);
6530
6531  MUST_USE_RESULT MaybeObject* Update(MapHandleList* maps,
6532                                      Code::Flags flags,
6533                                      Code* code);
6534
6535  // Returns an undefined value if the entry is not found.
6536  Handle<Object> Lookup(MapHandleList* maps, Code::Flags flags);
6537
6538  static inline PolymorphicCodeCache* cast(Object* obj);
6539
6540#ifdef OBJECT_PRINT
6541  inline void PolymorphicCodeCachePrint() {
6542    PolymorphicCodeCachePrint(stdout);
6543  }
6544  void PolymorphicCodeCachePrint(FILE* out);
6545#endif
6546#ifdef DEBUG
6547  void PolymorphicCodeCacheVerify();
6548#endif
6549
6550  static const int kCacheOffset = HeapObject::kHeaderSize;
6551  static const int kSize = kCacheOffset + kPointerSize;
6552
6553 private:
6554  DISALLOW_IMPLICIT_CONSTRUCTORS(PolymorphicCodeCache);
6555};
6556
6557
6558class PolymorphicCodeCacheHashTable
6559    : public HashTable<CodeCacheHashTableShape, HashTableKey*> {
6560 public:
6561  Object* Lookup(MapHandleList* maps, int code_kind);
6562
6563  MUST_USE_RESULT MaybeObject* Put(MapHandleList* maps,
6564                                   int code_kind,
6565                                   Code* code);
6566
6567  static inline PolymorphicCodeCacheHashTable* cast(Object* obj);
6568
6569  static const int kInitialSize = 64;
6570 private:
6571  DISALLOW_IMPLICIT_CONSTRUCTORS(PolymorphicCodeCacheHashTable);
6572};
6573
6574
6575class TypeFeedbackInfo: public Struct {
6576 public:
6577  inline int ic_total_count();
6578  inline void set_ic_total_count(int count);
6579
6580  inline int ic_with_type_info_count();
6581  inline void set_ic_with_type_info_count(int count);
6582
6583  DECL_ACCESSORS(type_feedback_cells, TypeFeedbackCells)
6584
6585  static inline TypeFeedbackInfo* cast(Object* obj);
6586
6587#ifdef OBJECT_PRINT
6588  inline void TypeFeedbackInfoPrint() {
6589    TypeFeedbackInfoPrint(stdout);
6590  }
6591  void TypeFeedbackInfoPrint(FILE* out);
6592#endif
6593#ifdef DEBUG
6594  void TypeFeedbackInfoVerify();
6595#endif
6596
6597  static const int kIcTotalCountOffset = HeapObject::kHeaderSize;
6598  static const int kIcWithTypeinfoCountOffset =
6599      kIcTotalCountOffset + kPointerSize;
6600  static const int kTypeFeedbackCellsOffset =
6601      kIcWithTypeinfoCountOffset + kPointerSize;
6602  static const int kSize = kTypeFeedbackCellsOffset + kPointerSize;
6603
6604 private:
6605  DISALLOW_IMPLICIT_CONSTRUCTORS(TypeFeedbackInfo);
6606};
6607
6608
6609// Representation of a slow alias as part of a non-strict arguments objects.
6610// For fast aliases (if HasNonStrictArgumentsElements()):
6611// - the parameter map contains an index into the context
6612// - all attributes of the element have default values
6613// For slow aliases (if HasDictionaryArgumentsElements()):
6614// - the parameter map contains no fast alias mapping (i.e. the hole)
6615// - this struct (in the slow backing store) contains an index into the context
6616// - all attributes are available as part if the property details
6617class AliasedArgumentsEntry: public Struct {
6618 public:
6619  inline int aliased_context_slot();
6620  inline void set_aliased_context_slot(int count);
6621
6622  static inline AliasedArgumentsEntry* cast(Object* obj);
6623
6624#ifdef OBJECT_PRINT
6625  inline void AliasedArgumentsEntryPrint() {
6626    AliasedArgumentsEntryPrint(stdout);
6627  }
6628  void AliasedArgumentsEntryPrint(FILE* out);
6629#endif
6630#ifdef DEBUG
6631  void AliasedArgumentsEntryVerify();
6632#endif
6633
6634  static const int kAliasedContextSlot = HeapObject::kHeaderSize;
6635  static const int kSize = kAliasedContextSlot + kPointerSize;
6636
6637 private:
6638  DISALLOW_IMPLICIT_CONSTRUCTORS(AliasedArgumentsEntry);
6639};
6640
6641
6642enum AllowNullsFlag {ALLOW_NULLS, DISALLOW_NULLS};
6643enum RobustnessFlag {ROBUST_STRING_TRAVERSAL, FAST_STRING_TRAVERSAL};
6644
6645
6646class StringHasher {
6647 public:
6648  explicit inline StringHasher(int length, uint32_t seed);
6649
6650  // Returns true if the hash of this string can be computed without
6651  // looking at the contents.
6652  inline bool has_trivial_hash();
6653
6654  // Add a character to the hash and update the array index calculation.
6655  inline void AddCharacter(uint32_t c);
6656
6657  // Adds a character to the hash but does not update the array index
6658  // calculation.  This can only be called when it has been verified
6659  // that the input is not an array index.
6660  inline void AddCharacterNoIndex(uint32_t c);
6661
6662  // Add a character above 0xffff as a surrogate pair.  These can get into
6663  // the hasher through the routines that take a UTF-8 string and make a symbol.
6664  void AddSurrogatePair(uc32 c);
6665  void AddSurrogatePairNoIndex(uc32 c);
6666
6667  // Returns the value to store in the hash field of a string with
6668  // the given length and contents.
6669  uint32_t GetHashField();
6670
6671  // Returns true if the characters seen so far make up a legal array
6672  // index.
6673  bool is_array_index() { return is_array_index_; }
6674
6675  bool is_valid() { return is_valid_; }
6676
6677  void invalidate() { is_valid_ = false; }
6678
6679  // Calculated hash value for a string consisting of 1 to
6680  // String::kMaxArrayIndexSize digits with no leading zeros (except "0").
6681  // value is represented decimal value.
6682  static uint32_t MakeArrayIndexHash(uint32_t value, int length);
6683
6684  // No string is allowed to have a hash of zero.  That value is reserved
6685  // for internal properties.  If the hash calculation yields zero then we
6686  // use 27 instead.
6687  static const int kZeroHash = 27;
6688
6689 private:
6690  uint32_t array_index() {
6691    ASSERT(is_array_index());
6692    return array_index_;
6693  }
6694
6695  inline uint32_t GetHash();
6696
6697  int length_;
6698  uint32_t raw_running_hash_;
6699  uint32_t array_index_;
6700  bool is_array_index_;
6701  bool is_first_char_;
6702  bool is_valid_;
6703  friend class TwoCharHashTableKey;
6704};
6705
6706
6707// Calculates string hash.
6708template <typename schar>
6709inline uint32_t HashSequentialString(const schar* chars,
6710                                     int length,
6711                                     uint32_t seed);
6712
6713
6714// The characteristics of a string are stored in its map.  Retrieving these
6715// few bits of information is moderately expensive, involving two memory
6716// loads where the second is dependent on the first.  To improve efficiency
6717// the shape of the string is given its own class so that it can be retrieved
6718// once and used for several string operations.  A StringShape is small enough
6719// to be passed by value and is immutable, but be aware that flattening a
6720// string can potentially alter its shape.  Also be aware that a GC caused by
6721// something else can alter the shape of a string due to ConsString
6722// shortcutting.  Keeping these restrictions in mind has proven to be error-
6723// prone and so we no longer put StringShapes in variables unless there is a
6724// concrete performance benefit at that particular point in the code.
6725class StringShape BASE_EMBEDDED {
6726 public:
6727  inline explicit StringShape(String* s);
6728  inline explicit StringShape(Map* s);
6729  inline explicit StringShape(InstanceType t);
6730  inline bool IsSequential();
6731  inline bool IsExternal();
6732  inline bool IsCons();
6733  inline bool IsSliced();
6734  inline bool IsIndirect();
6735  inline bool IsExternalAscii();
6736  inline bool IsExternalTwoByte();
6737  inline bool IsSequentialAscii();
6738  inline bool IsSequentialTwoByte();
6739  inline bool IsSymbol();
6740  inline StringRepresentationTag representation_tag();
6741  inline uint32_t encoding_tag();
6742  inline uint32_t full_representation_tag();
6743  inline uint32_t size_tag();
6744#ifdef DEBUG
6745  inline uint32_t type() { return type_; }
6746  inline void invalidate() { valid_ = false; }
6747  inline bool valid() { return valid_; }
6748#else
6749  inline void invalidate() { }
6750#endif
6751
6752 private:
6753  uint32_t type_;
6754#ifdef DEBUG
6755  inline void set_valid() { valid_ = true; }
6756  bool valid_;
6757#else
6758  inline void set_valid() { }
6759#endif
6760};
6761
6762
6763// The String abstract class captures JavaScript string values:
6764//
6765// Ecma-262:
6766//  4.3.16 String Value
6767//    A string value is a member of the type String and is a finite
6768//    ordered sequence of zero or more 16-bit unsigned integer values.
6769//
6770// All string values have a length field.
6771class String: public HeapObject {
6772 public:
6773  // Representation of the flat content of a String.
6774  // A non-flat string doesn't have flat content.
6775  // A flat string has content that's encoded as a sequence of either
6776  // ASCII chars or two-byte UC16.
6777  // Returned by String::GetFlatContent().
6778  class FlatContent {
6779   public:
6780    // Returns true if the string is flat and this structure contains content.
6781    bool IsFlat() { return state_ != NON_FLAT; }
6782    // Returns true if the structure contains ASCII content.
6783    bool IsAscii() { return state_ == ASCII; }
6784    // Returns true if the structure contains two-byte content.
6785    bool IsTwoByte() { return state_ == TWO_BYTE; }
6786
6787    // Return the ASCII content of the string. Only use if IsAscii() returns
6788    // true.
6789    Vector<const char> ToAsciiVector() {
6790      ASSERT_EQ(ASCII, state_);
6791      return Vector<const char>::cast(buffer_);
6792    }
6793    // Return the two-byte content of the string. Only use if IsTwoByte()
6794    // returns true.
6795    Vector<const uc16> ToUC16Vector() {
6796      ASSERT_EQ(TWO_BYTE, state_);
6797      return Vector<const uc16>::cast(buffer_);
6798    }
6799
6800   private:
6801    enum State { NON_FLAT, ASCII, TWO_BYTE };
6802
6803    // Constructors only used by String::GetFlatContent().
6804    explicit FlatContent(Vector<const char> chars)
6805        : buffer_(Vector<const byte>::cast(chars)),
6806          state_(ASCII) { }
6807    explicit FlatContent(Vector<const uc16> chars)
6808        : buffer_(Vector<const byte>::cast(chars)),
6809          state_(TWO_BYTE) { }
6810    FlatContent() : buffer_(), state_(NON_FLAT) { }
6811
6812    Vector<const byte> buffer_;
6813    State state_;
6814
6815    friend class String;
6816  };
6817
6818  // Get and set the length of the string.
6819  inline int length();
6820  inline void set_length(int value);
6821
6822  // Get and set the hash field of the string.
6823  inline uint32_t hash_field();
6824  inline void set_hash_field(uint32_t value);
6825
6826  // Returns whether this string has only ASCII chars, i.e. all of them can
6827  // be ASCII encoded.  This might be the case even if the string is
6828  // two-byte.  Such strings may appear when the embedder prefers
6829  // two-byte external representations even for ASCII data.
6830  inline bool IsAsciiRepresentation();
6831  inline bool IsTwoByteRepresentation();
6832
6833  // Cons and slices have an encoding flag that may not represent the actual
6834  // encoding of the underlying string.  This is taken into account here.
6835  // Requires: this->IsFlat()
6836  inline bool IsAsciiRepresentationUnderneath();
6837  inline bool IsTwoByteRepresentationUnderneath();
6838
6839  // NOTE: this should be considered only a hint.  False negatives are
6840  // possible.
6841  inline bool HasOnlyAsciiChars();
6842
6843  // Get and set individual two byte chars in the string.
6844  inline void Set(int index, uint16_t value);
6845  // Get individual two byte char in the string.  Repeated calls
6846  // to this method are not efficient unless the string is flat.
6847  inline uint16_t Get(int index);
6848
6849  // Try to flatten the string.  Checks first inline to see if it is
6850  // necessary.  Does nothing if the string is not a cons string.
6851  // Flattening allocates a sequential string with the same data as
6852  // the given string and mutates the cons string to a degenerate
6853  // form, where the first component is the new sequential string and
6854  // the second component is the empty string.  If allocation fails,
6855  // this function returns a failure.  If flattening succeeds, this
6856  // function returns the sequential string that is now the first
6857  // component of the cons string.
6858  //
6859  // Degenerate cons strings are handled specially by the garbage
6860  // collector (see IsShortcutCandidate).
6861  //
6862  // Use FlattenString from Handles.cc to flatten even in case an
6863  // allocation failure happens.
6864  inline MaybeObject* TryFlatten(PretenureFlag pretenure = NOT_TENURED);
6865
6866  // Convenience function.  Has exactly the same behavior as
6867  // TryFlatten(), except in the case of failure returns the original
6868  // string.
6869  inline String* TryFlattenGetString(PretenureFlag pretenure = NOT_TENURED);
6870
6871  // Tries to return the content of a flat string as a structure holding either
6872  // a flat vector of char or of uc16.
6873  // If the string isn't flat, and therefore doesn't have flat content, the
6874  // returned structure will report so, and can't provide a vector of either
6875  // kind.
6876  FlatContent GetFlatContent();
6877
6878  // Returns the parent of a sliced string or first part of a flat cons string.
6879  // Requires: StringShape(this).IsIndirect() && this->IsFlat()
6880  inline String* GetUnderlying();
6881
6882  // Mark the string as an undetectable object. It only applies to
6883  // ASCII and two byte string types.
6884  bool MarkAsUndetectable();
6885
6886  // Return a substring.
6887  MUST_USE_RESULT MaybeObject* SubString(int from,
6888                                         int to,
6889                                         PretenureFlag pretenure = NOT_TENURED);
6890
6891  // String equality operations.
6892  inline bool Equals(String* other);
6893  bool IsEqualTo(Vector<const char> str);
6894  bool IsAsciiEqualTo(Vector<const char> str);
6895  bool IsTwoByteEqualTo(Vector<const uc16> str);
6896
6897  // Return a UTF8 representation of the string.  The string is null
6898  // terminated but may optionally contain nulls.  Length is returned
6899  // in length_output if length_output is not a null pointer  The string
6900  // should be nearly flat, otherwise the performance of this method may
6901  // be very slow (quadratic in the length).  Setting robustness_flag to
6902  // ROBUST_STRING_TRAVERSAL invokes behaviour that is robust  This means it
6903  // handles unexpected data without causing assert failures and it does not
6904  // do any heap allocations.  This is useful when printing stack traces.
6905  SmartArrayPointer<char> ToCString(AllowNullsFlag allow_nulls,
6906                                    RobustnessFlag robustness_flag,
6907                                    int offset,
6908                                    int length,
6909                                    int* length_output = 0);
6910  SmartArrayPointer<char> ToCString(
6911      AllowNullsFlag allow_nulls = DISALLOW_NULLS,
6912      RobustnessFlag robustness_flag = FAST_STRING_TRAVERSAL,
6913      int* length_output = 0);
6914
6915  // Return a 16 bit Unicode representation of the string.
6916  // The string should be nearly flat, otherwise the performance of
6917  // of this method may be very bad.  Setting robustness_flag to
6918  // ROBUST_STRING_TRAVERSAL invokes behaviour that is robust  This means it
6919  // handles unexpected data without causing assert failures and it does not
6920  // do any heap allocations.  This is useful when printing stack traces.
6921  SmartArrayPointer<uc16> ToWideCString(
6922      RobustnessFlag robustness_flag = FAST_STRING_TRAVERSAL);
6923
6924  // Tells whether the hash code has been computed.
6925  inline bool HasHashCode();
6926
6927  // Returns a hash value used for the property table
6928  inline uint32_t Hash();
6929
6930  static uint32_t ComputeHashField(unibrow::CharacterStream* buffer,
6931                                   int length,
6932                                   uint32_t seed);
6933
6934  static bool ComputeArrayIndex(unibrow::CharacterStream* buffer,
6935                                uint32_t* index,
6936                                int length);
6937
6938  // Externalization.
6939  bool MakeExternal(v8::String::ExternalStringResource* resource);
6940  bool MakeExternal(v8::String::ExternalAsciiStringResource* resource);
6941
6942  // Conversion.
6943  inline bool AsArrayIndex(uint32_t* index);
6944
6945  // Casting.
6946  static inline String* cast(Object* obj);
6947
6948  void PrintOn(FILE* out);
6949
6950  // For use during stack traces.  Performs rudimentary sanity check.
6951  bool LooksValid();
6952
6953  // Dispatched behavior.
6954  void StringShortPrint(StringStream* accumulator);
6955#ifdef OBJECT_PRINT
6956  inline void StringPrint() {
6957    StringPrint(stdout);
6958  }
6959  void StringPrint(FILE* out);
6960
6961  char* ToAsciiArray();
6962#endif
6963#ifdef DEBUG
6964  void StringVerify();
6965#endif
6966  inline bool IsFlat();
6967
6968  // Layout description.
6969  static const int kLengthOffset = HeapObject::kHeaderSize;
6970  static const int kHashFieldOffset = kLengthOffset + kPointerSize;
6971  static const int kSize = kHashFieldOffset + kPointerSize;
6972
6973  // Maximum number of characters to consider when trying to convert a string
6974  // value into an array index.
6975  static const int kMaxArrayIndexSize = 10;
6976
6977  // Max ASCII char code.
6978  static const int kMaxAsciiCharCode = unibrow::Utf8::kMaxOneByteChar;
6979  static const unsigned kMaxAsciiCharCodeU = unibrow::Utf8::kMaxOneByteChar;
6980  static const int kMaxUtf16CodeUnit = 0xffff;
6981
6982  // Mask constant for checking if a string has a computed hash code
6983  // and if it is an array index.  The least significant bit indicates
6984  // whether a hash code has been computed.  If the hash code has been
6985  // computed the 2nd bit tells whether the string can be used as an
6986  // array index.
6987  static const int kHashNotComputedMask = 1;
6988  static const int kIsNotArrayIndexMask = 1 << 1;
6989  static const int kNofHashBitFields = 2;
6990
6991  // Shift constant retrieving hash code from hash field.
6992  static const int kHashShift = kNofHashBitFields;
6993
6994  // Only these bits are relevant in the hash, since the top two are shifted
6995  // out.
6996  static const uint32_t kHashBitMask = 0xffffffffu >> kHashShift;
6997
6998  // Array index strings this short can keep their index in the hash
6999  // field.
7000  static const int kMaxCachedArrayIndexLength = 7;
7001
7002  // For strings which are array indexes the hash value has the string length
7003  // mixed into the hash, mainly to avoid a hash value of zero which would be
7004  // the case for the string '0'. 24 bits are used for the array index value.
7005  static const int kArrayIndexValueBits = 24;
7006  static const int kArrayIndexLengthBits =
7007      kBitsPerInt - kArrayIndexValueBits - kNofHashBitFields;
7008
7009  STATIC_CHECK((kArrayIndexLengthBits > 0));
7010  STATIC_CHECK(kMaxArrayIndexSize < (1 << kArrayIndexLengthBits));
7011
7012  static const int kArrayIndexHashLengthShift =
7013      kArrayIndexValueBits + kNofHashBitFields;
7014
7015  static const int kArrayIndexHashMask = (1 << kArrayIndexHashLengthShift) - 1;
7016
7017  static const int kArrayIndexValueMask =
7018      ((1 << kArrayIndexValueBits) - 1) << kHashShift;
7019
7020  // Check that kMaxCachedArrayIndexLength + 1 is a power of two so we
7021  // could use a mask to test if the length of string is less than or equal to
7022  // kMaxCachedArrayIndexLength.
7023  STATIC_CHECK(IS_POWER_OF_TWO(kMaxCachedArrayIndexLength + 1));
7024
7025  static const int kContainsCachedArrayIndexMask =
7026      (~kMaxCachedArrayIndexLength << kArrayIndexHashLengthShift) |
7027      kIsNotArrayIndexMask;
7028
7029  // Value of empty hash field indicating that the hash is not computed.
7030  static const int kEmptyHashField =
7031      kIsNotArrayIndexMask | kHashNotComputedMask;
7032
7033  // Value of hash field containing computed hash equal to zero.
7034  static const int kZeroHash = kIsNotArrayIndexMask;
7035
7036  // Maximal string length.
7037  static const int kMaxLength = (1 << (32 - 2)) - 1;
7038
7039  // Max length for computing hash. For strings longer than this limit the
7040  // string length is used as the hash value.
7041  static const int kMaxHashCalcLength = 16383;
7042
7043  // Limit for truncation in short printing.
7044  static const int kMaxShortPrintLength = 1024;
7045
7046  // Support for regular expressions.
7047  const uc16* GetTwoByteData();
7048  const uc16* GetTwoByteData(unsigned start);
7049
7050  // Support for StringInputBuffer
7051  static const unibrow::byte* ReadBlock(String* input,
7052                                        unibrow::byte* util_buffer,
7053                                        unsigned capacity,
7054                                        unsigned* remaining,
7055                                        unsigned* offset);
7056  static const unibrow::byte* ReadBlock(String** input,
7057                                        unibrow::byte* util_buffer,
7058                                        unsigned capacity,
7059                                        unsigned* remaining,
7060                                        unsigned* offset);
7061
7062  // Helper function for flattening strings.
7063  template <typename sinkchar>
7064  static void WriteToFlat(String* source,
7065                          sinkchar* sink,
7066                          int from,
7067                          int to);
7068
7069  static inline bool IsAscii(const char* chars, int length) {
7070    const char* limit = chars + length;
7071#ifdef V8_HOST_CAN_READ_UNALIGNED
7072    ASSERT(kMaxAsciiCharCode == 0x7F);
7073    const uintptr_t non_ascii_mask = kUintptrAllBitsSet / 0xFF * 0x80;
7074    while (chars <= limit - sizeof(uintptr_t)) {
7075      if (*reinterpret_cast<const uintptr_t*>(chars) & non_ascii_mask) {
7076        return false;
7077      }
7078      chars += sizeof(uintptr_t);
7079    }
7080#endif
7081    while (chars < limit) {
7082      if (static_cast<uint8_t>(*chars) > kMaxAsciiCharCodeU) return false;
7083      ++chars;
7084    }
7085    return true;
7086  }
7087
7088  static inline bool IsAscii(const uc16* chars, int length) {
7089    const uc16* limit = chars + length;
7090    while (chars < limit) {
7091      if (*chars > kMaxAsciiCharCodeU) return false;
7092      ++chars;
7093    }
7094    return true;
7095  }
7096
7097 protected:
7098  class ReadBlockBuffer {
7099   public:
7100    ReadBlockBuffer(unibrow::byte* util_buffer_,
7101                    unsigned cursor_,
7102                    unsigned capacity_,
7103                    unsigned remaining_) :
7104      util_buffer(util_buffer_),
7105      cursor(cursor_),
7106      capacity(capacity_),
7107      remaining(remaining_) {
7108    }
7109    unibrow::byte* util_buffer;
7110    unsigned       cursor;
7111    unsigned       capacity;
7112    unsigned       remaining;
7113  };
7114
7115  static inline const unibrow::byte* ReadBlock(String* input,
7116                                               ReadBlockBuffer* buffer,
7117                                               unsigned* offset,
7118                                               unsigned max_chars);
7119  static void ReadBlockIntoBuffer(String* input,
7120                                  ReadBlockBuffer* buffer,
7121                                  unsigned* offset_ptr,
7122                                  unsigned max_chars);
7123
7124 private:
7125  // Try to flatten the top level ConsString that is hiding behind this
7126  // string.  This is a no-op unless the string is a ConsString.  Flatten
7127  // mutates the ConsString and might return a failure.
7128  MUST_USE_RESULT MaybeObject* SlowTryFlatten(PretenureFlag pretenure);
7129
7130  static inline bool IsHashFieldComputed(uint32_t field);
7131
7132  // Slow case of String::Equals.  This implementation works on any strings
7133  // but it is most efficient on strings that are almost flat.
7134  bool SlowEquals(String* other);
7135
7136  // Slow case of AsArrayIndex.
7137  bool SlowAsArrayIndex(uint32_t* index);
7138
7139  // Compute and set the hash code.
7140  uint32_t ComputeAndSetHash();
7141
7142  DISALLOW_IMPLICIT_CONSTRUCTORS(String);
7143};
7144
7145
7146// The SeqString abstract class captures sequential string values.
7147class SeqString: public String {
7148 public:
7149  // Casting.
7150  static inline SeqString* cast(Object* obj);
7151
7152  // Layout description.
7153  static const int kHeaderSize = String::kSize;
7154
7155 private:
7156  DISALLOW_IMPLICIT_CONSTRUCTORS(SeqString);
7157};
7158
7159
7160// The AsciiString class captures sequential ASCII string objects.
7161// Each character in the AsciiString is an ASCII character.
7162class SeqAsciiString: public SeqString {
7163 public:
7164  static const bool kHasAsciiEncoding = true;
7165
7166  // Dispatched behavior.
7167  inline uint16_t SeqAsciiStringGet(int index);
7168  inline void SeqAsciiStringSet(int index, uint16_t value);
7169
7170  // Get the address of the characters in this string.
7171  inline Address GetCharsAddress();
7172
7173  inline char* GetChars();
7174
7175  // Casting
7176  static inline SeqAsciiString* cast(Object* obj);
7177
7178  // Garbage collection support.  This method is called by the
7179  // garbage collector to compute the actual size of an AsciiString
7180  // instance.
7181  inline int SeqAsciiStringSize(InstanceType instance_type);
7182
7183  // Computes the size for an AsciiString instance of a given length.
7184  static int SizeFor(int length) {
7185    return OBJECT_POINTER_ALIGN(kHeaderSize + length * kCharSize);
7186  }
7187
7188  // Maximal memory usage for a single sequential ASCII string.
7189  static const int kMaxSize = 512 * MB - 1;
7190  // Maximal length of a single sequential ASCII string.
7191  // Q.v. String::kMaxLength which is the maximal size of concatenated strings.
7192  static const int kMaxLength = (kMaxSize - kHeaderSize);
7193
7194  // Support for StringInputBuffer.
7195  inline void SeqAsciiStringReadBlockIntoBuffer(ReadBlockBuffer* buffer,
7196                                                unsigned* offset,
7197                                                unsigned chars);
7198  inline const unibrow::byte* SeqAsciiStringReadBlock(unsigned* remaining,
7199                                                      unsigned* offset,
7200                                                      unsigned chars);
7201
7202 private:
7203  DISALLOW_IMPLICIT_CONSTRUCTORS(SeqAsciiString);
7204};
7205
7206
7207// The TwoByteString class captures sequential unicode string objects.
7208// Each character in the TwoByteString is a two-byte uint16_t.
7209class SeqTwoByteString: public SeqString {
7210 public:
7211  static const bool kHasAsciiEncoding = false;
7212
7213  // Dispatched behavior.
7214  inline uint16_t SeqTwoByteStringGet(int index);
7215  inline void SeqTwoByteStringSet(int index, uint16_t value);
7216
7217  // Get the address of the characters in this string.
7218  inline Address GetCharsAddress();
7219
7220  inline uc16* GetChars();
7221
7222  // For regexp code.
7223  const uint16_t* SeqTwoByteStringGetData(unsigned start);
7224
7225  // Casting
7226  static inline SeqTwoByteString* cast(Object* obj);
7227
7228  // Garbage collection support.  This method is called by the
7229  // garbage collector to compute the actual size of a TwoByteString
7230  // instance.
7231  inline int SeqTwoByteStringSize(InstanceType instance_type);
7232
7233  // Computes the size for a TwoByteString instance of a given length.
7234  static int SizeFor(int length) {
7235    return OBJECT_POINTER_ALIGN(kHeaderSize + length * kShortSize);
7236  }
7237
7238  // Maximal memory usage for a single sequential two-byte string.
7239  static const int kMaxSize = 512 * MB - 1;
7240  // Maximal length of a single sequential two-byte string.
7241  // Q.v. String::kMaxLength which is the maximal size of concatenated strings.
7242  static const int kMaxLength = (kMaxSize - kHeaderSize) / sizeof(uint16_t);
7243
7244  // Support for StringInputBuffer.
7245  inline void SeqTwoByteStringReadBlockIntoBuffer(ReadBlockBuffer* buffer,
7246                                                  unsigned* offset_ptr,
7247                                                  unsigned chars);
7248
7249 private:
7250  DISALLOW_IMPLICIT_CONSTRUCTORS(SeqTwoByteString);
7251};
7252
7253
7254// The ConsString class describes string values built by using the
7255// addition operator on strings.  A ConsString is a pair where the
7256// first and second components are pointers to other string values.
7257// One or both components of a ConsString can be pointers to other
7258// ConsStrings, creating a binary tree of ConsStrings where the leaves
7259// are non-ConsString string values.  The string value represented by
7260// a ConsString can be obtained by concatenating the leaf string
7261// values in a left-to-right depth-first traversal of the tree.
7262class ConsString: public String {
7263 public:
7264  // First string of the cons cell.
7265  inline String* first();
7266  // Doesn't check that the result is a string, even in debug mode.  This is
7267  // useful during GC where the mark bits confuse the checks.
7268  inline Object* unchecked_first();
7269  inline void set_first(String* first,
7270                        WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
7271
7272  // Second string of the cons cell.
7273  inline String* second();
7274  // Doesn't check that the result is a string, even in debug mode.  This is
7275  // useful during GC where the mark bits confuse the checks.
7276  inline Object* unchecked_second();
7277  inline void set_second(String* second,
7278                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
7279
7280  // Dispatched behavior.
7281  uint16_t ConsStringGet(int index);
7282
7283  // Casting.
7284  static inline ConsString* cast(Object* obj);
7285
7286  // Layout description.
7287  static const int kFirstOffset = POINTER_SIZE_ALIGN(String::kSize);
7288  static const int kSecondOffset = kFirstOffset + kPointerSize;
7289  static const int kSize = kSecondOffset + kPointerSize;
7290
7291  // Support for StringInputBuffer.
7292  inline const unibrow::byte* ConsStringReadBlock(ReadBlockBuffer* buffer,
7293                                                  unsigned* offset_ptr,
7294                                                  unsigned chars);
7295  inline void ConsStringReadBlockIntoBuffer(ReadBlockBuffer* buffer,
7296                                            unsigned* offset_ptr,
7297                                            unsigned chars);
7298
7299  // Minimum length for a cons string.
7300  static const int kMinLength = 13;
7301
7302  typedef FixedBodyDescriptor<kFirstOffset, kSecondOffset + kPointerSize, kSize>
7303          BodyDescriptor;
7304
7305#ifdef DEBUG
7306  void ConsStringVerify();
7307#endif
7308
7309 private:
7310  DISALLOW_IMPLICIT_CONSTRUCTORS(ConsString);
7311};
7312
7313
7314// The Sliced String class describes strings that are substrings of another
7315// sequential string.  The motivation is to save time and memory when creating
7316// a substring.  A Sliced String is described as a pointer to the parent,
7317// the offset from the start of the parent string and the length.  Using
7318// a Sliced String therefore requires unpacking of the parent string and
7319// adding the offset to the start address.  A substring of a Sliced String
7320// are not nested since the double indirection is simplified when creating
7321// such a substring.
7322// Currently missing features are:
7323//  - handling externalized parent strings
7324//  - external strings as parent
7325//  - truncating sliced string to enable otherwise unneeded parent to be GC'ed.
7326class SlicedString: public String {
7327 public:
7328  inline String* parent();
7329  inline void set_parent(String* parent);
7330  inline int offset();
7331  inline void set_offset(int offset);
7332
7333  // Dispatched behavior.
7334  uint16_t SlicedStringGet(int index);
7335
7336  // Casting.
7337  static inline SlicedString* cast(Object* obj);
7338
7339  // Layout description.
7340  static const int kParentOffset = POINTER_SIZE_ALIGN(String::kSize);
7341  static const int kOffsetOffset = kParentOffset + kPointerSize;
7342  static const int kSize = kOffsetOffset + kPointerSize;
7343
7344  // Support for StringInputBuffer
7345  inline const unibrow::byte* SlicedStringReadBlock(ReadBlockBuffer* buffer,
7346                                                    unsigned* offset_ptr,
7347                                                    unsigned chars);
7348  inline void SlicedStringReadBlockIntoBuffer(ReadBlockBuffer* buffer,
7349                                              unsigned* offset_ptr,
7350                                              unsigned chars);
7351  // Minimum length for a sliced string.
7352  static const int kMinLength = 13;
7353
7354  typedef FixedBodyDescriptor<kParentOffset,
7355                              kOffsetOffset + kPointerSize, kSize>
7356          BodyDescriptor;
7357
7358#ifdef DEBUG
7359  void SlicedStringVerify();
7360#endif
7361
7362 private:
7363  DISALLOW_IMPLICIT_CONSTRUCTORS(SlicedString);
7364};
7365
7366
7367// The ExternalString class describes string values that are backed by
7368// a string resource that lies outside the V8 heap.  ExternalStrings
7369// consist of the length field common to all strings, a pointer to the
7370// external resource.  It is important to ensure (externally) that the
7371// resource is not deallocated while the ExternalString is live in the
7372// V8 heap.
7373//
7374// The API expects that all ExternalStrings are created through the
7375// API.  Therefore, ExternalStrings should not be used internally.
7376class ExternalString: public String {
7377 public:
7378  // Casting
7379  static inline ExternalString* cast(Object* obj);
7380
7381  // Layout description.
7382  static const int kResourceOffset = POINTER_SIZE_ALIGN(String::kSize);
7383  static const int kShortSize = kResourceOffset + kPointerSize;
7384  static const int kResourceDataOffset = kResourceOffset + kPointerSize;
7385  static const int kSize = kResourceDataOffset + kPointerSize;
7386
7387  // Return whether external string is short (data pointer is not cached).
7388  inline bool is_short();
7389
7390  STATIC_CHECK(kResourceOffset == Internals::kStringResourceOffset);
7391
7392 private:
7393  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalString);
7394};
7395
7396
7397// The ExternalAsciiString class is an external string backed by an
7398// ASCII string.
7399class ExternalAsciiString: public ExternalString {
7400 public:
7401  static const bool kHasAsciiEncoding = true;
7402
7403  typedef v8::String::ExternalAsciiStringResource Resource;
7404
7405  // The underlying resource.
7406  inline const Resource* resource();
7407  inline void set_resource(const Resource* buffer);
7408
7409  // Update the pointer cache to the external character array.
7410  // The cached pointer is always valid, as the external character array does =
7411  // not move during lifetime.  Deserialization is the only exception, after
7412  // which the pointer cache has to be refreshed.
7413  inline void update_data_cache();
7414
7415  inline const char* GetChars();
7416
7417  // Dispatched behavior.
7418  inline uint16_t ExternalAsciiStringGet(int index);
7419
7420  // Casting.
7421  static inline ExternalAsciiString* cast(Object* obj);
7422
7423  // Garbage collection support.
7424  inline void ExternalAsciiStringIterateBody(ObjectVisitor* v);
7425
7426  template<typename StaticVisitor>
7427  inline void ExternalAsciiStringIterateBody();
7428
7429  // Support for StringInputBuffer.
7430  const unibrow::byte* ExternalAsciiStringReadBlock(unsigned* remaining,
7431                                                    unsigned* offset,
7432                                                    unsigned chars);
7433  inline void ExternalAsciiStringReadBlockIntoBuffer(ReadBlockBuffer* buffer,
7434                                                     unsigned* offset,
7435                                                     unsigned chars);
7436
7437 private:
7438  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalAsciiString);
7439};
7440
7441
7442// The ExternalTwoByteString class is an external string backed by a UTF-16
7443// encoded string.
7444class ExternalTwoByteString: public ExternalString {
7445 public:
7446  static const bool kHasAsciiEncoding = false;
7447
7448  typedef v8::String::ExternalStringResource Resource;
7449
7450  // The underlying string resource.
7451  inline const Resource* resource();
7452  inline void set_resource(const Resource* buffer);
7453
7454  // Update the pointer cache to the external character array.
7455  // The cached pointer is always valid, as the external character array does =
7456  // not move during lifetime.  Deserialization is the only exception, after
7457  // which the pointer cache has to be refreshed.
7458  inline void update_data_cache();
7459
7460  inline const uint16_t* GetChars();
7461
7462  // Dispatched behavior.
7463  inline uint16_t ExternalTwoByteStringGet(int index);
7464
7465  // For regexp code.
7466  inline const uint16_t* ExternalTwoByteStringGetData(unsigned start);
7467
7468  // Casting.
7469  static inline ExternalTwoByteString* cast(Object* obj);
7470
7471  // Garbage collection support.
7472  inline void ExternalTwoByteStringIterateBody(ObjectVisitor* v);
7473
7474  template<typename StaticVisitor>
7475  inline void ExternalTwoByteStringIterateBody();
7476
7477
7478  // Support for StringInputBuffer.
7479  void ExternalTwoByteStringReadBlockIntoBuffer(ReadBlockBuffer* buffer,
7480                                                unsigned* offset_ptr,
7481                                                unsigned chars);
7482
7483 private:
7484  DISALLOW_IMPLICIT_CONSTRUCTORS(ExternalTwoByteString);
7485};
7486
7487
7488// Utility superclass for stack-allocated objects that must be updated
7489// on gc.  It provides two ways for the gc to update instances, either
7490// iterating or updating after gc.
7491class Relocatable BASE_EMBEDDED {
7492 public:
7493  explicit inline Relocatable(Isolate* isolate);
7494  inline virtual ~Relocatable();
7495  virtual void IterateInstance(ObjectVisitor* v) { }
7496  virtual void PostGarbageCollection() { }
7497
7498  static void PostGarbageCollectionProcessing();
7499  static int ArchiveSpacePerThread();
7500  static char* ArchiveState(Isolate* isolate, char* to);
7501  static char* RestoreState(Isolate* isolate, char* from);
7502  static void Iterate(ObjectVisitor* v);
7503  static void Iterate(ObjectVisitor* v, Relocatable* top);
7504  static char* Iterate(ObjectVisitor* v, char* t);
7505 private:
7506  Isolate* isolate_;
7507  Relocatable* prev_;
7508};
7509
7510
7511// A flat string reader provides random access to the contents of a
7512// string independent of the character width of the string.  The handle
7513// must be valid as long as the reader is being used.
7514class FlatStringReader : public Relocatable {
7515 public:
7516  FlatStringReader(Isolate* isolate, Handle<String> str);
7517  FlatStringReader(Isolate* isolate, Vector<const char> input);
7518  void PostGarbageCollection();
7519  inline uc32 Get(int index);
7520  int length() { return length_; }
7521 private:
7522  String** str_;
7523  bool is_ascii_;
7524  int length_;
7525  const void* start_;
7526};
7527
7528
7529// Note that StringInputBuffers are not valid across a GC!  To fix this
7530// it would have to store a String Handle instead of a String* and
7531// AsciiStringReadBlock would have to be modified to use memcpy.
7532//
7533// StringInputBuffer is able to traverse any string regardless of how
7534// deeply nested a sequence of ConsStrings it is made of.  However,
7535// performance will be better if deep strings are flattened before they
7536// are traversed.  Since flattening requires memory allocation this is
7537// not always desirable, however (esp. in debugging situations).
7538class StringInputBuffer: public unibrow::InputBuffer<String, String*, 1024> {
7539 public:
7540  virtual void Seek(unsigned pos);
7541  inline StringInputBuffer(): unibrow::InputBuffer<String, String*, 1024>() {}
7542  explicit inline StringInputBuffer(String* backing):
7543      unibrow::InputBuffer<String, String*, 1024>(backing) {}
7544};
7545
7546
7547class SafeStringInputBuffer
7548  : public unibrow::InputBuffer<String, String**, 256> {
7549 public:
7550  virtual void Seek(unsigned pos);
7551  inline SafeStringInputBuffer()
7552      : unibrow::InputBuffer<String, String**, 256>() {}
7553  explicit inline SafeStringInputBuffer(String** backing)
7554      : unibrow::InputBuffer<String, String**, 256>(backing) {}
7555};
7556
7557
7558template <typename T>
7559class VectorIterator {
7560 public:
7561  VectorIterator(T* d, int l) : data_(Vector<const T>(d, l)), index_(0) { }
7562  explicit VectorIterator(Vector<const T> data) : data_(data), index_(0) { }
7563  T GetNext() { return data_[index_++]; }
7564  bool has_more() { return index_ < data_.length(); }
7565 private:
7566  Vector<const T> data_;
7567  int index_;
7568};
7569
7570
7571// The Oddball describes objects null, undefined, true, and false.
7572class Oddball: public HeapObject {
7573 public:
7574  // [to_string]: Cached to_string computed at startup.
7575  DECL_ACCESSORS(to_string, String)
7576
7577  // [to_number]: Cached to_number computed at startup.
7578  DECL_ACCESSORS(to_number, Object)
7579
7580  inline byte kind();
7581  inline void set_kind(byte kind);
7582
7583  // Casting.
7584  static inline Oddball* cast(Object* obj);
7585
7586  // Dispatched behavior.
7587#ifdef DEBUG
7588  void OddballVerify();
7589#endif
7590
7591  // Initialize the fields.
7592  MUST_USE_RESULT MaybeObject* Initialize(const char* to_string,
7593                                          Object* to_number,
7594                                          byte kind);
7595
7596  // Layout description.
7597  static const int kToStringOffset = HeapObject::kHeaderSize;
7598  static const int kToNumberOffset = kToStringOffset + kPointerSize;
7599  static const int kKindOffset = kToNumberOffset + kPointerSize;
7600  static const int kSize = kKindOffset + kPointerSize;
7601
7602  static const byte kFalse = 0;
7603  static const byte kTrue = 1;
7604  static const byte kNotBooleanMask = ~1;
7605  static const byte kTheHole = 2;
7606  static const byte kNull = 3;
7607  static const byte kArgumentMarker = 4;
7608  static const byte kUndefined = 5;
7609  static const byte kOther = 6;
7610
7611  typedef FixedBodyDescriptor<kToStringOffset,
7612                              kToNumberOffset + kPointerSize,
7613                              kSize> BodyDescriptor;
7614
7615 private:
7616  DISALLOW_IMPLICIT_CONSTRUCTORS(Oddball);
7617};
7618
7619
7620class JSGlobalPropertyCell: public HeapObject {
7621 public:
7622  // [value]: value of the global property.
7623  DECL_ACCESSORS(value, Object)
7624
7625  // Casting.
7626  static inline JSGlobalPropertyCell* cast(Object* obj);
7627
7628#ifdef DEBUG
7629  void JSGlobalPropertyCellVerify();
7630#endif
7631#ifdef OBJECT_PRINT
7632  inline void JSGlobalPropertyCellPrint() {
7633    JSGlobalPropertyCellPrint(stdout);
7634  }
7635  void JSGlobalPropertyCellPrint(FILE* out);
7636#endif
7637
7638  // Layout description.
7639  static const int kValueOffset = HeapObject::kHeaderSize;
7640  static const int kSize = kValueOffset + kPointerSize;
7641
7642  typedef FixedBodyDescriptor<kValueOffset,
7643                              kValueOffset + kPointerSize,
7644                              kSize> BodyDescriptor;
7645
7646 private:
7647  DISALLOW_IMPLICIT_CONSTRUCTORS(JSGlobalPropertyCell);
7648};
7649
7650
7651// The JSProxy describes EcmaScript Harmony proxies
7652class JSProxy: public JSReceiver {
7653 public:
7654  // [handler]: The handler property.
7655  DECL_ACCESSORS(handler, Object)
7656
7657  // [hash]: The hash code property (undefined if not initialized yet).
7658  DECL_ACCESSORS(hash, Object)
7659
7660  // Casting.
7661  static inline JSProxy* cast(Object* obj);
7662
7663  bool HasPropertyWithHandler(String* name);
7664  bool HasElementWithHandler(uint32_t index);
7665
7666  MUST_USE_RESULT MaybeObject* GetPropertyWithHandler(
7667      Object* receiver,
7668      String* name);
7669  MUST_USE_RESULT MaybeObject* GetElementWithHandler(
7670      Object* receiver,
7671      uint32_t index);
7672
7673  MUST_USE_RESULT MaybeObject* SetPropertyWithHandler(
7674      String* name,
7675      Object* value,
7676      PropertyAttributes attributes,
7677      StrictModeFlag strict_mode);
7678  MUST_USE_RESULT MaybeObject* SetElementWithHandler(
7679      uint32_t index,
7680      Object* value,
7681      StrictModeFlag strict_mode);
7682
7683  // If the handler defines an accessor property, invoke its setter
7684  // (or throw if only a getter exists) and set *found to true. Otherwise false.
7685  MUST_USE_RESULT MaybeObject* SetPropertyWithHandlerIfDefiningSetter(
7686      String* name,
7687      Object* value,
7688      PropertyAttributes attributes,
7689      StrictModeFlag strict_mode,
7690      bool* found);
7691
7692  MUST_USE_RESULT MaybeObject* DeletePropertyWithHandler(
7693      String* name,
7694      DeleteMode mode);
7695  MUST_USE_RESULT MaybeObject* DeleteElementWithHandler(
7696      uint32_t index,
7697      DeleteMode mode);
7698
7699  MUST_USE_RESULT PropertyAttributes GetPropertyAttributeWithHandler(
7700      JSReceiver* receiver,
7701      String* name);
7702  MUST_USE_RESULT PropertyAttributes GetElementAttributeWithHandler(
7703      JSReceiver* receiver,
7704      uint32_t index);
7705
7706  MUST_USE_RESULT MaybeObject* GetIdentityHash(CreationFlag flag);
7707
7708  // Turn this into an (empty) JSObject.
7709  void Fix();
7710
7711  // Initializes the body after the handler slot.
7712  inline void InitializeBody(int object_size, Object* value);
7713
7714  // Invoke a trap by name. If the trap does not exist on this's handler,
7715  // but derived_trap is non-NULL, invoke that instead.  May cause GC.
7716  Handle<Object> CallTrap(const char* name,
7717                          Handle<Object> derived_trap,
7718                          int argc,
7719                          Handle<Object> args[]);
7720
7721  // Dispatched behavior.
7722#ifdef OBJECT_PRINT
7723  inline void JSProxyPrint() {
7724    JSProxyPrint(stdout);
7725  }
7726  void JSProxyPrint(FILE* out);
7727#endif
7728#ifdef DEBUG
7729  void JSProxyVerify();
7730#endif
7731
7732  // Layout description. We add padding so that a proxy has the same
7733  // size as a virgin JSObject. This is essential for becoming a JSObject
7734  // upon freeze.
7735  static const int kHandlerOffset = HeapObject::kHeaderSize;
7736  static const int kHashOffset = kHandlerOffset + kPointerSize;
7737  static const int kPaddingOffset = kHashOffset + kPointerSize;
7738  static const int kSize = JSObject::kHeaderSize;
7739  static const int kHeaderSize = kPaddingOffset;
7740  static const int kPaddingSize = kSize - kPaddingOffset;
7741
7742  STATIC_CHECK(kPaddingSize >= 0);
7743
7744  typedef FixedBodyDescriptor<kHandlerOffset,
7745                              kPaddingOffset,
7746                              kSize> BodyDescriptor;
7747
7748 private:
7749  DISALLOW_IMPLICIT_CONSTRUCTORS(JSProxy);
7750};
7751
7752
7753class JSFunctionProxy: public JSProxy {
7754 public:
7755  // [call_trap]: The call trap.
7756  DECL_ACCESSORS(call_trap, Object)
7757
7758  // [construct_trap]: The construct trap.
7759  DECL_ACCESSORS(construct_trap, Object)
7760
7761  // Casting.
7762  static inline JSFunctionProxy* cast(Object* obj);
7763
7764  // Dispatched behavior.
7765#ifdef OBJECT_PRINT
7766  inline void JSFunctionProxyPrint() {
7767    JSFunctionProxyPrint(stdout);
7768  }
7769  void JSFunctionProxyPrint(FILE* out);
7770#endif
7771#ifdef DEBUG
7772  void JSFunctionProxyVerify();
7773#endif
7774
7775  // Layout description.
7776  static const int kCallTrapOffset = JSProxy::kPaddingOffset;
7777  static const int kConstructTrapOffset = kCallTrapOffset + kPointerSize;
7778  static const int kPaddingOffset = kConstructTrapOffset + kPointerSize;
7779  static const int kSize = JSFunction::kSize;
7780  static const int kPaddingSize = kSize - kPaddingOffset;
7781
7782  STATIC_CHECK(kPaddingSize >= 0);
7783
7784  typedef FixedBodyDescriptor<kHandlerOffset,
7785                              kConstructTrapOffset + kPointerSize,
7786                              kSize> BodyDescriptor;
7787
7788 private:
7789  DISALLOW_IMPLICIT_CONSTRUCTORS(JSFunctionProxy);
7790};
7791
7792
7793// The JSSet describes EcmaScript Harmony sets
7794class JSSet: public JSObject {
7795 public:
7796  // [set]: the backing hash set containing keys.
7797  DECL_ACCESSORS(table, Object)
7798
7799  // Casting.
7800  static inline JSSet* cast(Object* obj);
7801
7802#ifdef OBJECT_PRINT
7803  inline void JSSetPrint() {
7804    JSSetPrint(stdout);
7805  }
7806  void JSSetPrint(FILE* out);
7807#endif
7808#ifdef DEBUG
7809  void JSSetVerify();
7810#endif
7811
7812  static const int kTableOffset = JSObject::kHeaderSize;
7813  static const int kSize = kTableOffset + kPointerSize;
7814
7815 private:
7816  DISALLOW_IMPLICIT_CONSTRUCTORS(JSSet);
7817};
7818
7819
7820// The JSMap describes EcmaScript Harmony maps
7821class JSMap: public JSObject {
7822 public:
7823  // [table]: the backing hash table mapping keys to values.
7824  DECL_ACCESSORS(table, Object)
7825
7826  // Casting.
7827  static inline JSMap* cast(Object* obj);
7828
7829#ifdef OBJECT_PRINT
7830  inline void JSMapPrint() {
7831    JSMapPrint(stdout);
7832  }
7833  void JSMapPrint(FILE* out);
7834#endif
7835#ifdef DEBUG
7836  void JSMapVerify();
7837#endif
7838
7839  static const int kTableOffset = JSObject::kHeaderSize;
7840  static const int kSize = kTableOffset + kPointerSize;
7841
7842 private:
7843  DISALLOW_IMPLICIT_CONSTRUCTORS(JSMap);
7844};
7845
7846
7847// The JSWeakMap describes EcmaScript Harmony weak maps
7848class JSWeakMap: public JSObject {
7849 public:
7850  // [table]: the backing hash table mapping keys to values.
7851  DECL_ACCESSORS(table, Object)
7852
7853  // [next]: linked list of encountered weak maps during GC.
7854  DECL_ACCESSORS(next, Object)
7855
7856  // Casting.
7857  static inline JSWeakMap* cast(Object* obj);
7858
7859#ifdef OBJECT_PRINT
7860  inline void JSWeakMapPrint() {
7861    JSWeakMapPrint(stdout);
7862  }
7863  void JSWeakMapPrint(FILE* out);
7864#endif
7865#ifdef DEBUG
7866  void JSWeakMapVerify();
7867#endif
7868
7869  static const int kTableOffset = JSObject::kHeaderSize;
7870  static const int kNextOffset = kTableOffset + kPointerSize;
7871  static const int kSize = kNextOffset + kPointerSize;
7872
7873 private:
7874  DISALLOW_IMPLICIT_CONSTRUCTORS(JSWeakMap);
7875};
7876
7877
7878// Foreign describes objects pointing from JavaScript to C structures.
7879// Since they cannot contain references to JS HeapObjects they can be
7880// placed in old_data_space.
7881class Foreign: public HeapObject {
7882 public:
7883  // [address]: field containing the address.
7884  inline Address foreign_address();
7885  inline void set_foreign_address(Address value);
7886
7887  // Casting.
7888  static inline Foreign* cast(Object* obj);
7889
7890  // Dispatched behavior.
7891  inline void ForeignIterateBody(ObjectVisitor* v);
7892
7893  template<typename StaticVisitor>
7894  inline void ForeignIterateBody();
7895
7896#ifdef OBJECT_PRINT
7897  inline void ForeignPrint() {
7898    ForeignPrint(stdout);
7899  }
7900  void ForeignPrint(FILE* out);
7901#endif
7902#ifdef DEBUG
7903  void ForeignVerify();
7904#endif
7905
7906  // Layout description.
7907
7908  static const int kForeignAddressOffset = HeapObject::kHeaderSize;
7909  static const int kSize = kForeignAddressOffset + kPointerSize;
7910
7911  STATIC_CHECK(kForeignAddressOffset == Internals::kForeignAddressOffset);
7912
7913 private:
7914  DISALLOW_IMPLICIT_CONSTRUCTORS(Foreign);
7915};
7916
7917
7918// The JSArray describes JavaScript Arrays
7919//  Such an array can be in one of two modes:
7920//    - fast, backing storage is a FixedArray and length <= elements.length();
7921//       Please note: push and pop can be used to grow and shrink the array.
7922//    - slow, backing storage is a HashTable with numbers as keys.
7923class JSArray: public JSObject {
7924 public:
7925  // [length]: The length property.
7926  DECL_ACCESSORS(length, Object)
7927
7928  // Overload the length setter to skip write barrier when the length
7929  // is set to a smi. This matches the set function on FixedArray.
7930  inline void set_length(Smi* length);
7931
7932  MUST_USE_RESULT MaybeObject* JSArrayUpdateLengthFromIndex(uint32_t index,
7933                                                            Object* value);
7934
7935  // Initialize the array with the given capacity. The function may
7936  // fail due to out-of-memory situations, but only if the requested
7937  // capacity is non-zero.
7938  MUST_USE_RESULT MaybeObject* Initialize(int capacity);
7939
7940  // Initializes the array to a certain length.
7941  inline bool AllowsSetElementsLength();
7942  MUST_USE_RESULT MaybeObject* SetElementsLength(Object* length);
7943
7944  // Set the content of the array to the content of storage.
7945  MUST_USE_RESULT inline MaybeObject* SetContent(FixedArrayBase* storage);
7946
7947  // Casting.
7948  static inline JSArray* cast(Object* obj);
7949
7950  // Uses handles.  Ensures that the fixed array backing the JSArray has at
7951  // least the stated size.
7952  inline void EnsureSize(int minimum_size_of_backing_fixed_array);
7953
7954  // Dispatched behavior.
7955#ifdef OBJECT_PRINT
7956  inline void JSArrayPrint() {
7957    JSArrayPrint(stdout);
7958  }
7959  void JSArrayPrint(FILE* out);
7960#endif
7961#ifdef DEBUG
7962  void JSArrayVerify();
7963#endif
7964
7965  // Number of element slots to pre-allocate for an empty array.
7966  static const int kPreallocatedArrayElements = 4;
7967
7968  // Layout description.
7969  static const int kLengthOffset = JSObject::kHeaderSize;
7970  static const int kSize = kLengthOffset + kPointerSize;
7971
7972 private:
7973  // Expand the fixed array backing of a fast-case JSArray to at least
7974  // the requested size.
7975  void Expand(int minimum_size_of_backing_fixed_array);
7976
7977  DISALLOW_IMPLICIT_CONSTRUCTORS(JSArray);
7978};
7979
7980
7981// JSRegExpResult is just a JSArray with a specific initial map.
7982// This initial map adds in-object properties for "index" and "input"
7983// properties, as assigned by RegExp.prototype.exec, which allows
7984// faster creation of RegExp exec results.
7985// This class just holds constants used when creating the result.
7986// After creation the result must be treated as a JSArray in all regards.
7987class JSRegExpResult: public JSArray {
7988 public:
7989  // Offsets of object fields.
7990  static const int kIndexOffset = JSArray::kSize;
7991  static const int kInputOffset = kIndexOffset + kPointerSize;
7992  static const int kSize = kInputOffset + kPointerSize;
7993  // Indices of in-object properties.
7994  static const int kIndexIndex = 0;
7995  static const int kInputIndex = 1;
7996 private:
7997  DISALLOW_IMPLICIT_CONSTRUCTORS(JSRegExpResult);
7998};
7999
8000
8001// An accessor must have a getter, but can have no setter.
8002//
8003// When setting a property, V8 searches accessors in prototypes.
8004// If an accessor was found and it does not have a setter,
8005// the request is ignored.
8006//
8007// If the accessor in the prototype has the READ_ONLY property attribute, then
8008// a new value is added to the local object when the property is set.
8009// This shadows the accessor in the prototype.
8010class AccessorInfo: public Struct {
8011 public:
8012  DECL_ACCESSORS(getter, Object)
8013  DECL_ACCESSORS(setter, Object)
8014  DECL_ACCESSORS(data, Object)
8015  DECL_ACCESSORS(name, Object)
8016  DECL_ACCESSORS(flag, Smi)
8017
8018  inline bool all_can_read();
8019  inline void set_all_can_read(bool value);
8020
8021  inline bool all_can_write();
8022  inline void set_all_can_write(bool value);
8023
8024  inline bool prohibits_overwriting();
8025  inline void set_prohibits_overwriting(bool value);
8026
8027  inline PropertyAttributes property_attributes();
8028  inline void set_property_attributes(PropertyAttributes attributes);
8029
8030  static inline AccessorInfo* cast(Object* obj);
8031
8032#ifdef OBJECT_PRINT
8033  inline void AccessorInfoPrint() {
8034    AccessorInfoPrint(stdout);
8035  }
8036  void AccessorInfoPrint(FILE* out);
8037#endif
8038#ifdef DEBUG
8039  void AccessorInfoVerify();
8040#endif
8041
8042  static const int kGetterOffset = HeapObject::kHeaderSize;
8043  static const int kSetterOffset = kGetterOffset + kPointerSize;
8044  static const int kDataOffset = kSetterOffset + kPointerSize;
8045  static const int kNameOffset = kDataOffset + kPointerSize;
8046  static const int kFlagOffset = kNameOffset + kPointerSize;
8047  static const int kSize = kFlagOffset + kPointerSize;
8048
8049 private:
8050  // Bit positions in flag.
8051  static const int kAllCanReadBit = 0;
8052  static const int kAllCanWriteBit = 1;
8053  static const int kProhibitsOverwritingBit = 2;
8054  class AttributesField: public BitField<PropertyAttributes, 3, 3> {};
8055
8056  DISALLOW_IMPLICIT_CONSTRUCTORS(AccessorInfo);
8057};
8058
8059
8060// Support for JavaScript accessors: A pair of a getter and a setter. Each
8061// accessor can either be
8062//   * a pointer to a JavaScript function or proxy: a real accessor
8063//   * undefined: considered an accessor by the spec, too, strangely enough
8064//   * the hole: an accessor which has not been set
8065//   * a pointer to a map: a transition used to ensure map sharing
8066class AccessorPair: public Struct {
8067 public:
8068  DECL_ACCESSORS(getter, Object)
8069  DECL_ACCESSORS(setter, Object)
8070
8071  static inline AccessorPair* cast(Object* obj);
8072
8073  MUST_USE_RESULT MaybeObject* CopyWithoutTransitions();
8074
8075  // Note: Returns undefined instead in case of a hole.
8076  Object* GetComponent(AccessorComponent component);
8077
8078  // Set both components, skipping arguments which are a JavaScript null.
8079  void SetComponents(Object* getter, Object* setter) {
8080    if (!getter->IsNull()) set_getter(getter);
8081    if (!setter->IsNull()) set_setter(setter);
8082  }
8083
8084  bool ContainsAccessor() {
8085    return IsJSAccessor(getter()) || IsJSAccessor(setter());
8086  }
8087
8088#ifdef OBJECT_PRINT
8089  void AccessorPairPrint(FILE* out = stdout);
8090#endif
8091#ifdef DEBUG
8092  void AccessorPairVerify();
8093#endif
8094
8095  static const int kGetterOffset = HeapObject::kHeaderSize;
8096  static const int kSetterOffset = kGetterOffset + kPointerSize;
8097  static const int kSize = kSetterOffset + kPointerSize;
8098
8099 private:
8100  // Strangely enough, in addition to functions and harmony proxies, the spec
8101  // requires us to consider undefined as a kind of accessor, too:
8102  //    var obj = {};
8103  //    Object.defineProperty(obj, "foo", {get: undefined});
8104  //    assertTrue("foo" in obj);
8105  bool IsJSAccessor(Object* obj) {
8106    return obj->IsSpecFunction() || obj->IsUndefined();
8107  }
8108
8109  DISALLOW_IMPLICIT_CONSTRUCTORS(AccessorPair);
8110};
8111
8112
8113class AccessCheckInfo: public Struct {
8114 public:
8115  DECL_ACCESSORS(named_callback, Object)
8116  DECL_ACCESSORS(indexed_callback, Object)
8117  DECL_ACCESSORS(data, Object)
8118
8119  static inline AccessCheckInfo* cast(Object* obj);
8120
8121#ifdef OBJECT_PRINT
8122  inline void AccessCheckInfoPrint() {
8123    AccessCheckInfoPrint(stdout);
8124  }
8125  void AccessCheckInfoPrint(FILE* out);
8126#endif
8127#ifdef DEBUG
8128  void AccessCheckInfoVerify();
8129#endif
8130
8131  static const int kNamedCallbackOffset   = HeapObject::kHeaderSize;
8132  static const int kIndexedCallbackOffset = kNamedCallbackOffset + kPointerSize;
8133  static const int kDataOffset = kIndexedCallbackOffset + kPointerSize;
8134  static const int kSize = kDataOffset + kPointerSize;
8135
8136 private:
8137  DISALLOW_IMPLICIT_CONSTRUCTORS(AccessCheckInfo);
8138};
8139
8140
8141class InterceptorInfo: public Struct {
8142 public:
8143  DECL_ACCESSORS(getter, Object)
8144  DECL_ACCESSORS(setter, Object)
8145  DECL_ACCESSORS(query, Object)
8146  DECL_ACCESSORS(deleter, Object)
8147  DECL_ACCESSORS(enumerator, Object)
8148  DECL_ACCESSORS(data, Object)
8149
8150  static inline InterceptorInfo* cast(Object* obj);
8151
8152#ifdef OBJECT_PRINT
8153  inline void InterceptorInfoPrint() {
8154    InterceptorInfoPrint(stdout);
8155  }
8156  void InterceptorInfoPrint(FILE* out);
8157#endif
8158#ifdef DEBUG
8159  void InterceptorInfoVerify();
8160#endif
8161
8162  static const int kGetterOffset = HeapObject::kHeaderSize;
8163  static const int kSetterOffset = kGetterOffset + kPointerSize;
8164  static const int kQueryOffset = kSetterOffset + kPointerSize;
8165  static const int kDeleterOffset = kQueryOffset + kPointerSize;
8166  static const int kEnumeratorOffset = kDeleterOffset + kPointerSize;
8167  static const int kDataOffset = kEnumeratorOffset + kPointerSize;
8168  static const int kSize = kDataOffset + kPointerSize;
8169
8170 private:
8171  DISALLOW_IMPLICIT_CONSTRUCTORS(InterceptorInfo);
8172};
8173
8174
8175class CallHandlerInfo: public Struct {
8176 public:
8177  DECL_ACCESSORS(callback, Object)
8178  DECL_ACCESSORS(data, Object)
8179
8180  static inline CallHandlerInfo* cast(Object* obj);
8181
8182#ifdef OBJECT_PRINT
8183  inline void CallHandlerInfoPrint() {
8184    CallHandlerInfoPrint(stdout);
8185  }
8186  void CallHandlerInfoPrint(FILE* out);
8187#endif
8188#ifdef DEBUG
8189  void CallHandlerInfoVerify();
8190#endif
8191
8192  static const int kCallbackOffset = HeapObject::kHeaderSize;
8193  static const int kDataOffset = kCallbackOffset + kPointerSize;
8194  static const int kSize = kDataOffset + kPointerSize;
8195
8196 private:
8197  DISALLOW_IMPLICIT_CONSTRUCTORS(CallHandlerInfo);
8198};
8199
8200
8201class TemplateInfo: public Struct {
8202 public:
8203  DECL_ACCESSORS(tag, Object)
8204  DECL_ACCESSORS(property_list, Object)
8205
8206#ifdef DEBUG
8207  void TemplateInfoVerify();
8208#endif
8209
8210  static const int kTagOffset          = HeapObject::kHeaderSize;
8211  static const int kPropertyListOffset = kTagOffset + kPointerSize;
8212  static const int kHeaderSize         = kPropertyListOffset + kPointerSize;
8213
8214 private:
8215  DISALLOW_IMPLICIT_CONSTRUCTORS(TemplateInfo);
8216};
8217
8218
8219class FunctionTemplateInfo: public TemplateInfo {
8220 public:
8221  DECL_ACCESSORS(serial_number, Object)
8222  DECL_ACCESSORS(call_code, Object)
8223  DECL_ACCESSORS(property_accessors, Object)
8224  DECL_ACCESSORS(prototype_template, Object)
8225  DECL_ACCESSORS(parent_template, Object)
8226  DECL_ACCESSORS(named_property_handler, Object)
8227  DECL_ACCESSORS(indexed_property_handler, Object)
8228  DECL_ACCESSORS(instance_template, Object)
8229  DECL_ACCESSORS(class_name, Object)
8230  DECL_ACCESSORS(signature, Object)
8231  DECL_ACCESSORS(instance_call_handler, Object)
8232  DECL_ACCESSORS(access_check_info, Object)
8233  DECL_ACCESSORS(flag, Smi)
8234
8235  // Following properties use flag bits.
8236  DECL_BOOLEAN_ACCESSORS(hidden_prototype)
8237  DECL_BOOLEAN_ACCESSORS(undetectable)
8238  // If the bit is set, object instances created by this function
8239  // requires access check.
8240  DECL_BOOLEAN_ACCESSORS(needs_access_check)
8241  DECL_BOOLEAN_ACCESSORS(read_only_prototype)
8242
8243  static inline FunctionTemplateInfo* cast(Object* obj);
8244
8245#ifdef OBJECT_PRINT
8246  inline void FunctionTemplateInfoPrint() {
8247    FunctionTemplateInfoPrint(stdout);
8248  }
8249  void FunctionTemplateInfoPrint(FILE* out);
8250#endif
8251#ifdef DEBUG
8252  void FunctionTemplateInfoVerify();
8253#endif
8254
8255  static const int kSerialNumberOffset = TemplateInfo::kHeaderSize;
8256  static const int kCallCodeOffset = kSerialNumberOffset + kPointerSize;
8257  static const int kPropertyAccessorsOffset = kCallCodeOffset + kPointerSize;
8258  static const int kPrototypeTemplateOffset =
8259      kPropertyAccessorsOffset + kPointerSize;
8260  static const int kParentTemplateOffset =
8261      kPrototypeTemplateOffset + kPointerSize;
8262  static const int kNamedPropertyHandlerOffset =
8263      kParentTemplateOffset + kPointerSize;
8264  static const int kIndexedPropertyHandlerOffset =
8265      kNamedPropertyHandlerOffset + kPointerSize;
8266  static const int kInstanceTemplateOffset =
8267      kIndexedPropertyHandlerOffset + kPointerSize;
8268  static const int kClassNameOffset = kInstanceTemplateOffset + kPointerSize;
8269  static const int kSignatureOffset = kClassNameOffset + kPointerSize;
8270  static const int kInstanceCallHandlerOffset = kSignatureOffset + kPointerSize;
8271  static const int kAccessCheckInfoOffset =
8272      kInstanceCallHandlerOffset + kPointerSize;
8273  static const int kFlagOffset = kAccessCheckInfoOffset + kPointerSize;
8274  static const int kSize = kFlagOffset + kPointerSize;
8275
8276 private:
8277  // Bit position in the flag, from least significant bit position.
8278  static const int kHiddenPrototypeBit   = 0;
8279  static const int kUndetectableBit      = 1;
8280  static const int kNeedsAccessCheckBit  = 2;
8281  static const int kReadOnlyPrototypeBit = 3;
8282
8283  DISALLOW_IMPLICIT_CONSTRUCTORS(FunctionTemplateInfo);
8284};
8285
8286
8287class ObjectTemplateInfo: public TemplateInfo {
8288 public:
8289  DECL_ACCESSORS(constructor, Object)
8290  DECL_ACCESSORS(internal_field_count, Object)
8291
8292  static inline ObjectTemplateInfo* cast(Object* obj);
8293
8294#ifdef OBJECT_PRINT
8295  inline void ObjectTemplateInfoPrint() {
8296    ObjectTemplateInfoPrint(stdout);
8297  }
8298  void ObjectTemplateInfoPrint(FILE* out);
8299#endif
8300#ifdef DEBUG
8301  void ObjectTemplateInfoVerify();
8302#endif
8303
8304  static const int kConstructorOffset = TemplateInfo::kHeaderSize;
8305  static const int kInternalFieldCountOffset =
8306      kConstructorOffset + kPointerSize;
8307  static const int kSize = kInternalFieldCountOffset + kPointerSize;
8308};
8309
8310
8311class SignatureInfo: public Struct {
8312 public:
8313  DECL_ACCESSORS(receiver, Object)
8314  DECL_ACCESSORS(args, Object)
8315
8316  static inline SignatureInfo* cast(Object* obj);
8317
8318#ifdef OBJECT_PRINT
8319  inline void SignatureInfoPrint() {
8320    SignatureInfoPrint(stdout);
8321  }
8322  void SignatureInfoPrint(FILE* out);
8323#endif
8324#ifdef DEBUG
8325  void SignatureInfoVerify();
8326#endif
8327
8328  static const int kReceiverOffset = Struct::kHeaderSize;
8329  static const int kArgsOffset     = kReceiverOffset + kPointerSize;
8330  static const int kSize           = kArgsOffset + kPointerSize;
8331
8332 private:
8333  DISALLOW_IMPLICIT_CONSTRUCTORS(SignatureInfo);
8334};
8335
8336
8337class TypeSwitchInfo: public Struct {
8338 public:
8339  DECL_ACCESSORS(types, Object)
8340
8341  static inline TypeSwitchInfo* cast(Object* obj);
8342
8343#ifdef OBJECT_PRINT
8344  inline void TypeSwitchInfoPrint() {
8345    TypeSwitchInfoPrint(stdout);
8346  }
8347  void TypeSwitchInfoPrint(FILE* out);
8348#endif
8349#ifdef DEBUG
8350  void TypeSwitchInfoVerify();
8351#endif
8352
8353  static const int kTypesOffset = Struct::kHeaderSize;
8354  static const int kSize        = kTypesOffset + kPointerSize;
8355};
8356
8357
8358#ifdef ENABLE_DEBUGGER_SUPPORT
8359// The DebugInfo class holds additional information for a function being
8360// debugged.
8361class DebugInfo: public Struct {
8362 public:
8363  // The shared function info for the source being debugged.
8364  DECL_ACCESSORS(shared, SharedFunctionInfo)
8365  // Code object for the original code.
8366  DECL_ACCESSORS(original_code, Code)
8367  // Code object for the patched code. This code object is the code object
8368  // currently active for the function.
8369  DECL_ACCESSORS(code, Code)
8370  // Fixed array holding status information for each active break point.
8371  DECL_ACCESSORS(break_points, FixedArray)
8372
8373  // Check if there is a break point at a code position.
8374  bool HasBreakPoint(int code_position);
8375  // Get the break point info object for a code position.
8376  Object* GetBreakPointInfo(int code_position);
8377  // Clear a break point.
8378  static void ClearBreakPoint(Handle<DebugInfo> debug_info,
8379                              int code_position,
8380                              Handle<Object> break_point_object);
8381  // Set a break point.
8382  static void SetBreakPoint(Handle<DebugInfo> debug_info, int code_position,
8383                            int source_position, int statement_position,
8384                            Handle<Object> break_point_object);
8385  // Get the break point objects for a code position.
8386  Object* GetBreakPointObjects(int code_position);
8387  // Find the break point info holding this break point object.
8388  static Object* FindBreakPointInfo(Handle<DebugInfo> debug_info,
8389                                    Handle<Object> break_point_object);
8390  // Get the number of break points for this function.
8391  int GetBreakPointCount();
8392
8393  static inline DebugInfo* cast(Object* obj);
8394
8395#ifdef OBJECT_PRINT
8396  inline void DebugInfoPrint() {
8397    DebugInfoPrint(stdout);
8398  }
8399  void DebugInfoPrint(FILE* out);
8400#endif
8401#ifdef DEBUG
8402  void DebugInfoVerify();
8403#endif
8404
8405  static const int kSharedFunctionInfoIndex = Struct::kHeaderSize;
8406  static const int kOriginalCodeIndex = kSharedFunctionInfoIndex + kPointerSize;
8407  static const int kPatchedCodeIndex = kOriginalCodeIndex + kPointerSize;
8408  static const int kActiveBreakPointsCountIndex =
8409      kPatchedCodeIndex + kPointerSize;
8410  static const int kBreakPointsStateIndex =
8411      kActiveBreakPointsCountIndex + kPointerSize;
8412  static const int kSize = kBreakPointsStateIndex + kPointerSize;
8413
8414 private:
8415  static const int kNoBreakPointInfo = -1;
8416
8417  // Lookup the index in the break_points array for a code position.
8418  int GetBreakPointInfoIndex(int code_position);
8419
8420  DISALLOW_IMPLICIT_CONSTRUCTORS(DebugInfo);
8421};
8422
8423
8424// The BreakPointInfo class holds information for break points set in a
8425// function. The DebugInfo object holds a BreakPointInfo object for each code
8426// position with one or more break points.
8427class BreakPointInfo: public Struct {
8428 public:
8429  // The position in the code for the break point.
8430  DECL_ACCESSORS(code_position, Smi)
8431  // The position in the source for the break position.
8432  DECL_ACCESSORS(source_position, Smi)
8433  // The position in the source for the last statement before this break
8434  // position.
8435  DECL_ACCESSORS(statement_position, Smi)
8436  // List of related JavaScript break points.
8437  DECL_ACCESSORS(break_point_objects, Object)
8438
8439  // Removes a break point.
8440  static void ClearBreakPoint(Handle<BreakPointInfo> info,
8441                              Handle<Object> break_point_object);
8442  // Set a break point.
8443  static void SetBreakPoint(Handle<BreakPointInfo> info,
8444                            Handle<Object> break_point_object);
8445  // Check if break point info has this break point object.
8446  static bool HasBreakPointObject(Handle<BreakPointInfo> info,
8447                                  Handle<Object> break_point_object);
8448  // Get the number of break points for this code position.
8449  int GetBreakPointCount();
8450
8451  static inline BreakPointInfo* cast(Object* obj);
8452
8453#ifdef OBJECT_PRINT
8454  inline void BreakPointInfoPrint() {
8455    BreakPointInfoPrint(stdout);
8456  }
8457  void BreakPointInfoPrint(FILE* out);
8458#endif
8459#ifdef DEBUG
8460  void BreakPointInfoVerify();
8461#endif
8462
8463  static const int kCodePositionIndex = Struct::kHeaderSize;
8464  static const int kSourcePositionIndex = kCodePositionIndex + kPointerSize;
8465  static const int kStatementPositionIndex =
8466      kSourcePositionIndex + kPointerSize;
8467  static const int kBreakPointObjectsIndex =
8468      kStatementPositionIndex + kPointerSize;
8469  static const int kSize = kBreakPointObjectsIndex + kPointerSize;
8470
8471 private:
8472  DISALLOW_IMPLICIT_CONSTRUCTORS(BreakPointInfo);
8473};
8474#endif  // ENABLE_DEBUGGER_SUPPORT
8475
8476
8477#undef DECL_BOOLEAN_ACCESSORS
8478#undef DECL_ACCESSORS
8479
8480#define VISITOR_SYNCHRONIZATION_TAGS_LIST(V)                            \
8481  V(kSymbolTable, "symbol_table", "(Symbols)")                          \
8482  V(kExternalStringsTable, "external_strings_table", "(External strings)") \
8483  V(kStrongRootList, "strong_root_list", "(Strong roots)")              \
8484  V(kSymbol, "symbol", "(Symbol)")                                      \
8485  V(kBootstrapper, "bootstrapper", "(Bootstrapper)")                    \
8486  V(kTop, "top", "(Isolate)")                                           \
8487  V(kRelocatable, "relocatable", "(Relocatable)")                       \
8488  V(kDebug, "debug", "(Debugger)")                                      \
8489  V(kCompilationCache, "compilationcache", "(Compilation cache)")       \
8490  V(kHandleScope, "handlescope", "(Handle scope)")                      \
8491  V(kBuiltins, "builtins", "(Builtins)")                                \
8492  V(kGlobalHandles, "globalhandles", "(Global handles)")                \
8493  V(kThreadManager, "threadmanager", "(Thread manager)")                \
8494  V(kExtensions, "Extensions", "(Extensions)")
8495
8496class VisitorSynchronization : public AllStatic {
8497 public:
8498#define DECLARE_ENUM(enum_item, ignore1, ignore2) enum_item,
8499  enum SyncTag {
8500    VISITOR_SYNCHRONIZATION_TAGS_LIST(DECLARE_ENUM)
8501    kNumberOfSyncTags
8502  };
8503#undef DECLARE_ENUM
8504
8505  static const char* const kTags[kNumberOfSyncTags];
8506  static const char* const kTagNames[kNumberOfSyncTags];
8507};
8508
8509// Abstract base class for visiting, and optionally modifying, the
8510// pointers contained in Objects. Used in GC and serialization/deserialization.
8511class ObjectVisitor BASE_EMBEDDED {
8512 public:
8513  virtual ~ObjectVisitor() {}
8514
8515  // Visits a contiguous arrays of pointers in the half-open range
8516  // [start, end). Any or all of the values may be modified on return.
8517  virtual void VisitPointers(Object** start, Object** end) = 0;
8518
8519  // To allow lazy clearing of inline caches the visitor has
8520  // a rich interface for iterating over Code objects..
8521
8522  // Visits a code target in the instruction stream.
8523  virtual void VisitCodeTarget(RelocInfo* rinfo);
8524
8525  // Visits a code entry in a JS function.
8526  virtual void VisitCodeEntry(Address entry_address);
8527
8528  // Visits a global property cell reference in the instruction stream.
8529  virtual void VisitGlobalPropertyCell(RelocInfo* rinfo);
8530
8531  // Visits a runtime entry in the instruction stream.
8532  virtual void VisitRuntimeEntry(RelocInfo* rinfo) {}
8533
8534  // Visits the resource of an ASCII or two-byte string.
8535  virtual void VisitExternalAsciiString(
8536      v8::String::ExternalAsciiStringResource** resource) {}
8537  virtual void VisitExternalTwoByteString(
8538      v8::String::ExternalStringResource** resource) {}
8539
8540  // Visits a debug call target in the instruction stream.
8541  virtual void VisitDebugTarget(RelocInfo* rinfo);
8542
8543  // Handy shorthand for visiting a single pointer.
8544  virtual void VisitPointer(Object** p) { VisitPointers(p, p + 1); }
8545
8546  // Visit pointer embedded into a code object.
8547  virtual void VisitEmbeddedPointer(RelocInfo* rinfo);
8548
8549  virtual void VisitSharedFunctionInfo(SharedFunctionInfo* shared) {}
8550
8551  // Visits a contiguous arrays of external references (references to the C++
8552  // heap) in the half-open range [start, end). Any or all of the values
8553  // may be modified on return.
8554  virtual void VisitExternalReferences(Address* start, Address* end) {}
8555
8556  virtual void VisitExternalReference(RelocInfo* rinfo);
8557
8558  inline void VisitExternalReference(Address* p) {
8559    VisitExternalReferences(p, p + 1);
8560  }
8561
8562  // Visits a handle that has an embedder-assigned class ID.
8563  virtual void VisitEmbedderReference(Object** p, uint16_t class_id) {}
8564
8565  // Intended for serialization/deserialization checking: insert, or
8566  // check for the presence of, a tag at this position in the stream.
8567  // Also used for marking up GC roots in heap snapshots.
8568  virtual void Synchronize(VisitorSynchronization::SyncTag tag) {}
8569};
8570
8571
8572class StructBodyDescriptor : public
8573  FlexibleBodyDescriptor<HeapObject::kHeaderSize> {
8574 public:
8575  static inline int SizeOf(Map* map, HeapObject* object) {
8576    return map->instance_size();
8577  }
8578};
8579
8580
8581// BooleanBit is a helper class for setting and getting a bit in an
8582// integer or Smi.
8583class BooleanBit : public AllStatic {
8584 public:
8585  static inline bool get(Smi* smi, int bit_position) {
8586    return get(smi->value(), bit_position);
8587  }
8588
8589  static inline bool get(int value, int bit_position) {
8590    return (value & (1 << bit_position)) != 0;
8591  }
8592
8593  static inline Smi* set(Smi* smi, int bit_position, bool v) {
8594    return Smi::FromInt(set(smi->value(), bit_position, v));
8595  }
8596
8597  static inline int set(int value, int bit_position, bool v) {
8598    if (v) {
8599      value |= (1 << bit_position);
8600    } else {
8601      value &= ~(1 << bit_position);
8602    }
8603    return value;
8604  }
8605};
8606
8607} }  // namespace v8::internal
8608
8609#endif  // V8_OBJECTS_H_
8610