/*

* Copyright (C) 2017-2021 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "AccessCase.h"

#if ENABLE(JIT)

#include "CCallHelpers.h"

#include "CacheableIdentifierInlines.h"

#include "CallLinkInfo.h"

#include "DirectArguments.h"

#include "GetterSetter.h"

#include "GetterSetterAccessCase.h"

#include "InstanceOfAccessCase.h"

#include "IntrinsicGetterAccessCase.h"

#include "JSCInlines.h"

#include "JSModuleEnvironment.h"

#include "JSModuleNamespaceObject.h"

#include "LLIntThunks.h"

#include "LinkBuffer.h"

#include "ModuleNamespaceAccessCase.h"

#include "PolymorphicAccess.h"

#include "ScopedArguments.h"

#include "ScratchRegisterAllocator.h"

#include "StructureStubInfo.h"

#include "SuperSampler.h"

#include "ThunkGenerators.h"

namespace JSC {

namespace AccessCaseInternal {

static constexpr bool verbose = false;

}

DEFINE_ALLOCATOR_WITH_HEAP_IDENTIFIER(AccessCase);

AccessCase::AccessCase(VM& vm, JSCell* owner, AccessType type, CacheableIdentifier identifier, PropertyOffset offset, Structure* structure, const ObjectPropertyConditionSet& conditionSet, RefPtr<PolyProtoAccessChain>&& prototypeAccessChain)

: m_type(type)

, m_offset(offset)

, m_polyProtoAccessChain(WTFMove(prototypeAccessChain))

, m_identifier(identifier)

{

m_structure.setMayBeNull(vm, owner, structure);

m_conditionSet = conditionSet;

RELEASE_ASSERT(m_conditionSet.isValid());

}

Ref<AccessCase> AccessCase::create(VM& vm, JSCell* owner, AccessType type, CacheableIdentifier identifier, PropertyOffset offset, Structure* structure, const ObjectPropertyConditionSet& conditionSet, RefPtr<PolyProtoAccessChain>&& prototypeAccessChain)

{

switch (type) {

case InHit:

case InMiss:

case DeleteNonConfigurable:

case DeleteMiss:

break;

case ArrayLength:

case StringLength:

case DirectArgumentsLength:

case ScopedArgumentsLength:

case ModuleNamespaceLoad:

case Replace:

case InstanceOfGeneric:

case IndexedInt32Load:

case IndexedDoubleLoad:

case IndexedContiguousLoad:

case IndexedArrayStorageLoad:

case IndexedScopedArgumentsLoad:

case IndexedDirectArgumentsLoad:

case IndexedTypedArrayInt8Load:

case IndexedTypedArrayUint8Load:

case IndexedTypedArrayUint8ClampedLoad:

case IndexedTypedArrayInt16Load:

case IndexedTypedArrayUint16Load:

case IndexedTypedArrayInt32Load:

case IndexedTypedArrayUint32Load:

case IndexedTypedArrayFloat32Load:

case IndexedTypedArrayFloat64Load:

case IndexedStringLoad:

case IndexedInt32Store:

case IndexedDoubleStore:

case IndexedContiguousStore:

case IndexedArrayStorageStore:

case IndexedTypedArrayInt8Store:

case IndexedTypedArrayUint8Store:

case IndexedTypedArrayUint8ClampedStore:

case IndexedTypedArrayInt16Store:

case IndexedTypedArrayUint16Store:

case IndexedTypedArrayInt32Store:

case IndexedTypedArrayUint32Store:

case IndexedTypedArrayFloat32Store:

case IndexedTypedArrayFloat64Store:

RELEASE_ASSERT(!prototypeAccessChain);

break;

default:

RELEASE_ASSERT_NOT_REACHED();

};

return adoptRef(*new AccessCase(vm, owner, type, identifier, offset, structure, conditionSet, WTFMove(prototypeAccessChain)));

}

RefPtr<AccessCase> AccessCase::createTransition(

VM& vm, JSCell* owner, CacheableIdentifier identifier, PropertyOffset offset, Structure* oldStructure, Structure* newStructure,

const ObjectPropertyConditionSet& conditionSet, RefPtr<PolyProtoAccessChain>&& prototypeAccessChain, const StructureStubInfo& stubInfo)

{

RELEASE_ASSERT(oldStructure == newStructure->previousID());

// Skip optimizing the case where we need a realloc, if we don't have

// enough registers to make it happen.

if (oldStructure->outOfLineCapacity() != newStructure->outOfLineCapacity()) {

// In 64 bits jsc uses 1 register for value, and it uses 2 registers in 32 bits

size_t requiredRegisters = 1; // stubInfo.valueRegs()

#if USE(JSVALUE32_64)

++requiredRegisters;

#endif

// 1 register for the property in 64 bits

++requiredRegisters;

#if USE(JSVALUE32_64)

// In 32 bits, jsc uses may use one extra register, if it is not a Cell

if (stubInfo.propertyRegs().tagGPR() != InvalidGPRReg)

++requiredRegisters;

#endif

// 1 register for the base in 64 bits

++requiredRegisters;

#if USE(JSVALUE32_64)

// In 32 bits, jsc uses may use one extra register, if it is not a Cell

if (stubInfo.baseRegs().tagGPR() != InvalidGPRReg)

++requiredRegisters;

#endif

if (stubInfo.m_stubInfoGPR != InvalidGPRReg)

++requiredRegisters;

if (stubInfo.m_arrayProfileGPR != InvalidGPRReg)

++requiredRegisters;

// One extra register for scratchGPR

++requiredRegisters;

// Check if we have enough registers when reallocating

if (oldStructure->outOfLineCapacity() && GPRInfo::numberOfRegisters < requiredRegisters)

return nullptr;

// If we are (re)allocating inline, jsc needs two extra scratchGPRs

if (!oldStructure->couldHaveIndexingHeader() && GPRInfo::numberOfRegisters < (requiredRegisters + 2))

return nullptr;

}

return adoptRef(*new AccessCase(vm, owner, Transition, identifier, offset, newStructure, conditionSet, WTFMove(prototypeAccessChain)));

}

Ref<AccessCase> AccessCase::createDelete(

VM& vm, JSCell* owner, CacheableIdentifier identifier, PropertyOffset offset, Structure* oldStructure, Structure* newStructure)

{

RELEASE_ASSERT(oldStructure == newStructure->previousID());

ASSERT(!newStructure->outOfLineCapacity() || oldStructure->outOfLineCapacity());

return adoptRef(*new AccessCase(vm, owner, Delete, identifier, offset, newStructure, { }, { }));

}

Ref<AccessCase> AccessCase::createCheckPrivateBrand(VM& vm, JSCell* owner, CacheableIdentifier identifier, Structure* structure)

{

return adoptRef(*new AccessCase(vm, owner, CheckPrivateBrand, identifier, invalidOffset, structure, { }, { }));

}

Ref<AccessCase> AccessCase::createSetPrivateBrand(

VM& vm, JSCell* owner, CacheableIdentifier identifier, Structure* oldStructure, Structure* newStructure)

{

RELEASE_ASSERT(oldStructure == newStructure->previousID());

return adoptRef(*new AccessCase(vm, owner, SetPrivateBrand, identifier, invalidOffset, newStructure, { }, { }));

}

AccessCase::~AccessCase()

{

}

RefPtr<AccessCase> AccessCase::fromStructureStubInfo(

VM& vm, JSCell* owner, CacheableIdentifier identifier, StructureStubInfo& stubInfo)

{

switch (stubInfo.cacheType()) {

case CacheType::GetByIdSelf:

RELEASE_ASSERT(stubInfo.hasConstantIdentifier);

return ProxyableAccessCase::create(vm, owner, Load, identifier, stubInfo.u.byIdSelf.offset, stubInfo.m_inlineAccessBaseStructure.get());

case CacheType::PutByIdReplace:

RELEASE_ASSERT(stubInfo.hasConstantIdentifier);

return AccessCase::create(vm, owner, Replace, identifier, stubInfo.u.byIdSelf.offset, stubInfo.m_inlineAccessBaseStructure.get());

case CacheType::InByIdSelf:

RELEASE_ASSERT(stubInfo.hasConstantIdentifier);

return AccessCase::create(vm, owner, InHit, identifier, stubInfo.u.byIdSelf.offset, stubInfo.m_inlineAccessBaseStructure.get());

case CacheType::ArrayLength:

RELEASE_ASSERT(stubInfo.hasConstantIdentifier);

return AccessCase::create(vm, owner, AccessCase::ArrayLength, identifier);

case CacheType::StringLength:

RELEASE_ASSERT(stubInfo.hasConstantIdentifier);

return AccessCase::create(vm, owner, AccessCase::StringLength, identifier);

default:

return nullptr;

}

}

bool AccessCase::hasAlternateBase() const

{

return !conditionSet().isEmpty();

}

JSObject* AccessCase::alternateBase() const

{

return conditionSet().slotBaseCondition().object();

}

Ref<AccessCase> AccessCase::clone() const

{

auto result = adoptRef(*new AccessCase(*this));

result->resetState();

return result;

}

Vector<WatchpointSet*, 2> AccessCase::commit(VM& vm)

{

// It's fine to commit something that is already committed. That arises when we switch to using

// newly allocated watchpoints. When it happens, it's not efficient - but we think that's OK

// because most AccessCases have no extra watchpoints anyway.

RELEASE_ASSERT(m_state == Primordial || m_state == Committed);

Vector<WatchpointSet*, 2> result;

Structure* structure = this->structure();

auto append = [&] (auto* set) {

ASSERT(set->isStillValid());

result.append(set);

};

if (m_identifier) {

if ((structure && structure->needImpurePropertyWatchpoint())

|| m_conditionSet.needImpurePropertyWatchpoint()

|| (m_polyProtoAccessChain && m_polyProtoAccessChain->needImpurePropertyWatchpoint(vm)))

append(vm.ensureWatchpointSetForImpureProperty(m_identifier.uid()));

}

if (additionalSet())

append(additionalSet());

if (structure

&& structure->hasRareData()

&& structure->rareData()->hasSharedPolyProtoWatchpoint()

&& structure->rareData()->sharedPolyProtoWatchpoint()->isStillValid()) {

WatchpointSet* set = structure->rareData()->sharedPolyProtoWatchpoint()->inflate();

append(set);

}

m_state = Committed;

return result;

}

bool AccessCase::guardedByStructureCheck(const StructureStubInfo& stubInfo) const

{

if (!stubInfo.hasConstantIdentifier)

return false;

return guardedByStructureCheckSkippingConstantIdentifierCheck();

}

bool AccessCase::guardedByStructureCheckSkippingConstantIdentifierCheck() const

{

if (viaProxy())

return false;

if (m_polyProtoAccessChain)

return false;

switch (m_type) {

case ArrayLength:

case StringLength:

case DirectArgumentsLength:

case ScopedArgumentsLength:

case ModuleNamespaceLoad:

case InstanceOfHit:

case InstanceOfMiss:

case InstanceOfGeneric:

case IndexedInt32Load:

case IndexedDoubleLoad:

case IndexedContiguousLoad:

case IndexedArrayStorageLoad:

case IndexedScopedArgumentsLoad:

case IndexedDirectArgumentsLoad:

case IndexedTypedArrayInt8Load:

case IndexedTypedArrayUint8Load:

case IndexedTypedArrayUint8ClampedLoad:

case IndexedTypedArrayInt16Load:

case IndexedTypedArrayUint16Load:

case IndexedTypedArrayInt32Load:

case IndexedTypedArrayUint32Load:

case IndexedTypedArrayFloat32Load:

case IndexedTypedArrayFloat64Load:

case IndexedStringLoad:

case IndexedInt32Store:

case IndexedDoubleStore:

case IndexedContiguousStore:

case IndexedArrayStorageStore:

case IndexedTypedArrayInt8Store:

case IndexedTypedArrayUint8Store:

case IndexedTypedArrayUint8ClampedStore:

case IndexedTypedArrayInt16Store:

case IndexedTypedArrayUint16Store:

case IndexedTypedArrayInt32Store:

case IndexedTypedArrayUint32Store:

case IndexedTypedArrayFloat32Store:

case IndexedTypedArrayFloat64Store:

return false;

default:

return true;

}

}

bool AccessCase::requiresIdentifierNameMatch() const

{

switch (m_type) {

case Load:

// We don't currently have a by_val for these puts, but we do care about the identifier.

case Transition:

case Delete:

case DeleteNonConfigurable:

case DeleteMiss:

case Replace:

case Miss:

case GetGetter:

case Getter:

case Setter:

case CustomValueGetter:

case CustomAccessorGetter:

case CustomValueSetter:

case CustomAccessorSetter:

case IntrinsicGetter:

case InHit:

case InMiss:

case ArrayLength:

case StringLength:

case DirectArgumentsLength:

case ScopedArgumentsLength:

case ModuleNamespaceLoad:

case CheckPrivateBrand:

case SetPrivateBrand:

return true;

case InstanceOfHit:

case InstanceOfMiss:

case InstanceOfGeneric:

case IndexedInt32Load:

case IndexedDoubleLoad:

case IndexedContiguousLoad:

case IndexedArrayStorageLoad:

case IndexedScopedArgumentsLoad:

case IndexedDirectArgumentsLoad:

case IndexedTypedArrayInt8Load:

case IndexedTypedArrayUint8Load:

case IndexedTypedArrayUint8ClampedLoad:

case IndexedTypedArrayInt16Load:

case IndexedTypedArrayUint16Load:

case IndexedTypedArrayInt32Load:

case IndexedTypedArrayUint32Load:

case IndexedTypedArrayFloat32Load:

case IndexedTypedArrayFloat64Load:

case IndexedStringLoad:

case IndexedInt32Store:

case IndexedDoubleStore:

case IndexedContiguousStore:

case IndexedArrayStorageStore:

case IndexedTypedArrayInt8Store:

case IndexedTypedArrayUint8Store:

case IndexedTypedArrayUint8ClampedStore:

case IndexedTypedArrayInt16Store:

case IndexedTypedArrayUint16Store:

case IndexedTypedArrayInt32Store:

case IndexedTypedArrayUint32Store:

case IndexedTypedArrayFloat32Store:

case IndexedTypedArrayFloat64Store:

return false;

}

RELEASE_ASSERT_NOT_REACHED();

}

bool AccessCase::requiresInt32PropertyCheck() const

{

switch (m_type) {

case Load:

case Transition:

case Delete:

case DeleteNonConfigurable:

case DeleteMiss:

case Replace:

case Miss:

case GetGetter:

case Getter:

case Setter:

case CustomValueGetter:

case CustomAccessorGetter:

case CustomValueSetter:

case CustomAccessorSetter:

case IntrinsicGetter:

case InHit:

case InMiss:

case ArrayLength:

case StringLength:

case DirectArgumentsLength:

case ScopedArgumentsLength:

case ModuleNamespaceLoad:

case InstanceOfHit:

case InstanceOfMiss:

case InstanceOfGeneric:

case CheckPrivateBrand:

case SetPrivateBrand:

return false;

case IndexedInt32Load:

case IndexedDoubleLoad:

case IndexedContiguousLoad:

case IndexedArrayStorageLoad:

case IndexedScopedArgumentsLoad:

case IndexedDirectArgumentsLoad:

case IndexedTypedArrayInt8Load:

case IndexedTypedArrayUint8Load:

case IndexedTypedArrayUint8ClampedLoad:

case IndexedTypedArrayInt16Load:

case IndexedTypedArrayUint16Load:

case IndexedTypedArrayInt32Load:

case IndexedTypedArrayUint32Load:

case IndexedTypedArrayFloat32Load:

case IndexedTypedArrayFloat64Load:

case IndexedStringLoad:

case IndexedInt32Store:

case IndexedDoubleStore:

case IndexedContiguousStore:

case IndexedArrayStorageStore:

case IndexedTypedArrayInt8Store:

case IndexedTypedArrayUint8Store:

case IndexedTypedArrayUint8ClampedStore:

case IndexedTypedArrayInt16Store:

case IndexedTypedArrayUint16Store:

case IndexedTypedArrayInt32Store:

case IndexedTypedArrayUint32Store:

case IndexedTypedArrayFloat32Store:

case IndexedTypedArrayFloat64Store:

return true;

}

RELEASE_ASSERT_NOT_REACHED();

}

bool AccessCase::needsScratchFPR() const

{

switch (m_type) {

case Load:

case Transition:

case Delete:

case DeleteNonConfigurable:

case DeleteMiss:

case Replace:

case Miss:

case GetGetter:

case Getter:

case Setter:

case CustomValueGetter:

case CustomAccessorGetter:

case CustomValueSetter:

case CustomAccessorSetter:

case IntrinsicGetter:

case InHit:

case InMiss:

case CheckPrivateBrand:

case SetPrivateBrand:

case ArrayLength:

case StringLength:

case DirectArgumentsLength:

case ScopedArgumentsLength:

case ModuleNamespaceLoad:

case InstanceOfHit:

case InstanceOfMiss:

case InstanceOfGeneric:

case IndexedInt32Load:

case IndexedContiguousLoad:

case IndexedArrayStorageLoad:

case IndexedScopedArgumentsLoad:

case IndexedDirectArgumentsLoad:

case IndexedTypedArrayInt8Load:

case IndexedTypedArrayUint8Load:

case IndexedTypedArrayUint8ClampedLoad:

case IndexedTypedArrayInt16Load:

case IndexedTypedArrayUint16Load:

case IndexedTypedArrayInt32Load:

case IndexedStringLoad:

case IndexedInt32Store:

case IndexedContiguousStore:

case IndexedArrayStorageStore:

case IndexedTypedArrayInt8Store:

case IndexedTypedArrayUint8Store:

case IndexedTypedArrayUint8ClampedStore:

case IndexedTypedArrayInt16Store:

case IndexedTypedArrayUint16Store:

case IndexedTypedArrayInt32Store:

return false;

case IndexedDoubleLoad:

case IndexedTypedArrayFloat32Load:

case IndexedTypedArrayFloat64Load:

case IndexedTypedArrayUint32Load:

case IndexedDoubleStore:

case IndexedTypedArrayUint32Store:

case IndexedTypedArrayFloat32Store:

case IndexedTypedArrayFloat64Store:

return true;

}

RELEASE_ASSERT_NOT_REACHED();

}

template<typename Functor>

void AccessCase::forEachDependentCell(VM& vm, const Functor& functor) const

{

m_conditionSet.forEachDependentCell(functor);

if (m_structure)

functor(m_structure.get());

if (m_polyProtoAccessChain) {

for (StructureID structureID : m_polyProtoAccessChain->chain())

functor(vm.getStructure(structureID));

}

switch (type()) {

case Getter:

case Setter: {

auto& accessor = this->as<GetterSetterAccessCase>();

if (accessor.callLinkInfo())

accessor.callLinkInfo()->forEachDependentCell(functor);

break;

}

case CustomValueGetter:

case CustomValueSetter: {

auto& accessor = this->as<GetterSetterAccessCase>();

if (accessor.customSlotBase())

functor(accessor.customSlotBase());

break;

}

case IntrinsicGetter: {

auto& intrinsic = this->as<IntrinsicGetterAccessCase>();

if (intrinsic.intrinsicFunction())

functor(intrinsic.intrinsicFunction());

break;

}

case ModuleNamespaceLoad: {

auto& accessCase = this->as<ModuleNamespaceAccessCase>();

if (accessCase.moduleNamespaceObject())

functor(accessCase.moduleNamespaceObject());

if (accessCase.moduleEnvironment())

functor(accessCase.moduleEnvironment());

break;

}

case InstanceOfHit:

case InstanceOfMiss:

if (as<InstanceOfAccessCase>().prototype())

functor(as<InstanceOfAccessCase>().prototype());

break;

case CustomAccessorGetter:

case CustomAccessorSetter:

case Load:

case Transition:

case Delete:

case DeleteNonConfigurable:

case DeleteMiss:

case Replace:

case Miss:

case GetGetter:

case InHit:

case InMiss:

case CheckPrivateBrand:

case SetPrivateBrand:

case ArrayLength:

case StringLength:

case DirectArgumentsLength:

case ScopedArgumentsLength:

case InstanceOfGeneric:

case IndexedInt32Load:

case IndexedDoubleLoad:

case IndexedContiguousLoad:

case IndexedArrayStorageLoad:

case IndexedScopedArgumentsLoad:

case IndexedDirectArgumentsLoad:

case IndexedTypedArrayInt8Load:

case IndexedTypedArrayUint8Load:

case IndexedTypedArrayUint8ClampedLoad:

case IndexedTypedArrayInt16Load:

case IndexedTypedArrayUint16Load:

case IndexedTypedArrayInt32Load:

case IndexedTypedArrayUint32Load:

case IndexedTypedArrayFloat32Load:

case IndexedTypedArrayFloat64Load:

case IndexedStringLoad:

case IndexedInt32Store:

case IndexedDoubleStore:

case IndexedContiguousStore:

case IndexedArrayStorageStore:

case IndexedTypedArrayInt8Store:

case IndexedTypedArrayUint8Store:

case IndexedTypedArrayUint8ClampedStore:

case IndexedTypedArrayInt16Store:

case IndexedTypedArrayUint16Store:

case IndexedTypedArrayInt32Store:

case IndexedTypedArrayUint32Store:

case IndexedTypedArrayFloat32Store:

case IndexedTypedArrayFloat64Store:

break;

}

}

bool AccessCase::doesCalls(VM& vm, Vector<JSCell*>* cellsToMarkIfDoesCalls) const

{

bool doesCalls = false;

switch (type()) {

case Transition:

doesCalls = newStructure()->outOfLineCapacity() != structure()->outOfLineCapacity() && structure()->couldHaveIndexingHeader();

break;

case Getter:

case Setter:

case CustomValueGetter:

case CustomAccessorGetter:

case CustomValueSetter:

case CustomAccessorSetter:

doesCalls = true;

break;

case Delete:

case DeleteNonConfigurable:

case DeleteMiss:

case Load:

case Miss:

case GetGetter:

case IntrinsicGetter:

case InHit:

case InMiss:

case CheckPrivateBrand:

case SetPrivateBrand:

case ArrayLength:

case StringLength:

case DirectArgumentsLength:

case ScopedArgumentsLength:

case ModuleNamespaceLoad:

case InstanceOfHit:

case InstanceOfMiss:

case InstanceOfGeneric:

case IndexedInt32Load:

case IndexedDoubleLoad:

case IndexedContiguousLoad:

case IndexedArrayStorageLoad:

case IndexedScopedArgumentsLoad:

case IndexedDirectArgumentsLoad:

case IndexedTypedArrayInt8Load:

case IndexedTypedArrayUint8Load:

case IndexedTypedArrayUint8ClampedLoad:

case IndexedTypedArrayInt16Load:

case IndexedTypedArrayUint16Load:

case IndexedTypedArrayInt32Load:

case IndexedTypedArrayUint32Load:

case IndexedTypedArrayFloat32Load:

case IndexedTypedArrayFloat64Load:

case IndexedStringLoad:

case IndexedInt32Store:

case IndexedDoubleStore:

case IndexedContiguousStore:

case IndexedArrayStorageStore:

case IndexedTypedArrayInt8Store:

case IndexedTypedArrayUint8Store:

case IndexedTypedArrayUint8ClampedStore:

case IndexedTypedArrayInt16Store:

case IndexedTypedArrayUint16Store:

case IndexedTypedArrayInt32Store:

case IndexedTypedArrayUint32Store:

case IndexedTypedArrayFloat32Store:

case IndexedTypedArrayFloat64Store:

doesCalls = false;

break;

case Replace:

doesCalls = viaProxy();

break;

}

if (doesCalls && cellsToMarkIfDoesCalls) {

forEachDependentCell(vm, [&](JSCell* cell) {

cellsToMarkIfDoesCalls->append(cell);

});

}

return doesCalls;

}

bool AccessCase::couldStillSucceed() const

{

for (const ObjectPropertyCondition& condition : m_conditionSet) {

if (condition.condition().kind() == PropertyCondition::Equivalence) {

if (!condition.isWatchableAssumingImpurePropertyWatchpoint(PropertyCondition::WatchabilityEffort::EnsureWatchability))

return false;

} else {

if (!condition.structureEnsuresValidityAssumingImpurePropertyWatchpoint())

return false;

}

}

return true;

}

bool AccessCase::canReplace(const AccessCase& other) const

{

// This puts in a good effort to try to figure out if 'other' is made superfluous by '*this'.

// It's fine for this to return false if it's in doubt.

//

// Note that if A->guardedByStructureCheck() && B->guardedByStructureCheck() then

// A->canReplace(B) == B->canReplace(A).

if (m_identifier != other.m_identifier)

return false;

if (viaProxy() != other.viaProxy())

return false;

auto checkPolyProtoAndStructure = [&] {

if (m_polyProtoAccessChain) {

if (!other.m_polyProtoAccessChain)

return false;

// This is the only check we need since PolyProtoAccessChain contains the base structure.

// If we ever change it to contain only the prototype chain, we'll also need to change

// this to check the base structure.

return structure() == other.structure()

&& *m_polyProtoAccessChain == *other.m_polyProtoAccessChain;

}

if (!guardedByStructureCheckSkippingConstantIdentifierCheck() || !other.guardedByStructureCheckSkippingConstantIdentifierCheck())

return false;

return structure() == other.structure();

};

switch (type()) {

case IndexedInt32Load:

case IndexedDoubleLoad:

case IndexedContiguousLoad:

case IndexedArrayStorageLoad:

case ArrayLength:

case StringLength:

case DirectArgumentsLength:

case ScopedArgumentsLength:

case IndexedScopedArgumentsLoad:

case IndexedDirectArgumentsLoad:

case IndexedTypedArrayInt8Load:

case IndexedTypedArrayUint8Load:

case IndexedTypedArrayUint8ClampedLoad:

case IndexedTypedArrayInt16Load:

case IndexedTypedArrayUint16Load:

case IndexedTypedArrayInt32Load:

case IndexedTypedArrayUint32Load:

case IndexedTypedArrayFloat32Load:

case IndexedTypedArrayFloat64Load:

case IndexedStringLoad:

case IndexedInt32Store:

case IndexedDoubleStore:

case IndexedContiguousStore:

case IndexedArrayStorageStore:

case IndexedTypedArrayInt8Store:

case IndexedTypedArrayUint8Store:

case IndexedTypedArrayUint8ClampedStore:

case IndexedTypedArrayInt16Store:

case IndexedTypedArrayUint16Store:

case IndexedTypedArrayInt32Store:

case IndexedTypedArrayUint32Store:

case IndexedTypedArrayFloat32Store:

case IndexedTypedArrayFloat64Store:

return other.type() == type();

case ModuleNamespaceLoad: {

if (other.type() != type())

return false;

auto& thisCase = this->as<ModuleNamespaceAccessCase>();

auto& otherCase = this->as<ModuleNamespaceAccessCase>();

return thisCase.moduleNamespaceObject() == otherCase.moduleNamespaceObject();

}

case InstanceOfHit:

case InstanceOfMiss: {

if (other.type() != type())

return false;

if (this->as<InstanceOfAccessCase>().prototype() != other.as<InstanceOfAccessCase>().prototype())

return false;

return structure() == other.structure();

}

case InstanceOfGeneric:

switch (other.type()) {

case InstanceOfGeneric:

case InstanceOfHit:

case InstanceOfMiss:

return true;

default:

return false;

}

case Load:

case Transition:

case Delete:

case DeleteNonConfigurable:

case DeleteMiss:

case Replace:

case Miss:

case GetGetter:

case Setter:

case CustomValueGetter:

case CustomAccessorGetter:

case CustomValueSetter:

case CustomAccessorSetter:

case InHit:

case InMiss:

case CheckPrivateBrand:

case SetPrivateBrand:

if (other.type() != type())

return false;

return checkPolyProtoAndStructure();

case IntrinsicGetter:

case Getter:

if (other.type() != Getter && other.type() != IntrinsicGetter)

return false;

return checkPolyProtoAndStructure();

}

RELEASE_ASSERT_NOT_REACHED();

}

void AccessCase::dump(PrintStream& out) const

{

out.print("\n", m_type, ": {");

Indenter indent;

CommaPrinter comma;

out.print(comma, m_state);

out.print(comma, "ident = '", m_identifier, "'");

if (isValidOffset(m_offset))

out.print(comma, "offset = ", m_offset);

++indent;

if (m_polyProtoAccessChain) {

out.print("\n", indent, "prototype access chain = ");

m_polyProtoAccessChain->dump(structure(), out);

} else {

if (m_type == Transition || m_type == Delete || m_type == SetPrivateBrand)

out.print("\n", indent, "from structure = ", pointerDump(structure()),

"\n", indent, "to structure = ", pointerDump(newStructure()));

else if (m_structure)

out.print("\n", indent, "structure = ", pointerDump(m_structure.get()));

}

if (!m_conditionSet.isEmpty())

out.print("\n", indent, "conditions = ", m_conditionSet);

dumpImpl(out, comma, indent);

out.print("}");

}

bool AccessCase::visitWeak(VM& vm) const

{

if (isAccessor()) {

auto& accessor = this->as<GetterSetterAccessCase>();

if (accessor.callLinkInfo())

accessor.callLinkInfo()->visitWeak(vm);

}

bool isValid = true;

forEachDependentCell(vm, [&](JSCell* cell) {

isValid &= vm.heap.isMarked(cell);

});

return isValid;

}

template<typename Visitor>

void AccessCase::propagateTransitions(Visitor& visitor) const

{

if (m_structure)

m_structure->markIfCheap(visitor);

if (m_polyProtoAccessChain) {

for (StructureID structureID : m_polyProtoAccessChain->chain())

visitor.vm().getStructure(structureID)->markIfCheap(visitor);

}

switch (m_type) {

case Transition:

case Delete:

if (visitor.isMarked(m_structure->previousID()))

visitor.appendUnbarriered(m_structure.get());

break;

default:

break;

}

}

template void AccessCase::propagateTransitions(AbstractSlotVisitor&) const;

template void AccessCase::propagateTransitions(SlotVisitor&) const;

template<typename Visitor>

void AccessCase::visitAggregateImpl(Visitor& visitor) const

{

m_identifier.visitAggregate(visitor);

}

DEFINE_VISIT_AGGREGATE_WITH_MODIFIER(AccessCase, const);

void AccessCase::generateWithGuard(

AccessGenerationState& state, CCallHelpers::JumpList& fallThrough)

{

SuperSamplerScope superSamplerScope(false);

checkConsistency(*state.stubInfo);

RELEASE_ASSERT(m_state == Committed);

m_state = Generated;

JSGlobalObject* globalObject = state.m_globalObject;

CCallHelpers& jit = *state.jit;

StructureStubInfo& stubInfo = *state.stubInfo;

VM& vm = state.m_vm;

JSValueRegs valueRegs = state.valueRegs;

GPRReg baseGPR = state.baseGPR;

GPRReg scratchGPR = state.scratchGPR;

if (requiresIdentifierNameMatch() && !stubInfo.hasConstantIdentifier) {

RELEASE_ASSERT(m_identifier);

GPRReg propertyGPR = state.u.propertyGPR;

// non-rope string check done inside polymorphic access.

if (uid()->isSymbol())

jit.loadPtr(MacroAssembler::Address(propertyGPR, Symbol::offsetOfSymbolImpl()), scratchGPR);

else

jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), scratchGPR);

fallThrough.append(jit.branchPtr(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::TrustedImmPtr(uid())));

}

auto emitDefaultGuard = [&] () {

if (m_polyProtoAccessChain) {

ASSERT(!viaProxy());

GPRReg baseForAccessGPR = state.scratchGPR;

jit.move(state.baseGPR, baseForAccessGPR);

m_polyProtoAccessChain->forEach(vm, structure(), [&] (Structure* structure, bool atEnd) {

fallThrough.append(

jit.branchStructure(

CCallHelpers::NotEqual,

CCallHelpers::Address(baseForAccessGPR, JSCell::structureIDOffset()),

structure));

if (atEnd) {

if ((m_type == Miss || m_type == InMiss || m_type == Transition) && structure->hasPolyProto()) {

// For a Miss/InMiss/Transition, we must ensure we're at the end when the last item is poly proto.

// Transitions must do this because they need to verify there isn't a setter in the chain.

// Miss/InMiss need to do this to ensure there isn't a new item at the end of the chain that

// has the property.

#if USE(JSVALUE64)

jit.load64(MacroAssembler::Address(baseForAccessGPR, offsetRelativeToBase(knownPolyProtoOffset)), baseForAccessGPR);

fallThrough.append(jit.branch64(CCallHelpers::NotEqual, baseForAccessGPR, CCallHelpers::TrustedImm64(JSValue::ValueNull)));

#else

jit.load32(MacroAssembler::Address(baseForAccessGPR, offsetRelativeToBase(knownPolyProtoOffset) + PayloadOffset), baseForAccessGPR);

fallThrough.append(jit.branchTestPtr(CCallHelpers::NonZero, baseForAccessGPR));

#endif

}

} else {

if (structure->hasMonoProto()) {

JSValue prototype = structure->prototypeForLookup(globalObject);

RELEASE_ASSERT(prototype.isObject());

jit.move(CCallHelpers::TrustedImmPtr(asObject(prototype)), baseForAccessGPR);

} else {

RELEASE_ASSERT(structure->isObject()); // Primitives must have a stored prototype. We use prototypeForLookup for them.

#if USE(JSVALUE64)

jit.load64(MacroAssembler::Address(baseForAccessGPR, offsetRelativeToBase(knownPolyProtoOffset)), baseForAccessGPR);