// Copyright 2017 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #ifndef V8_OBJECTS_MAP_H_ #define V8_OBJECTS_MAP_H_ #include "src/common/globals.h" #include "src/objects/code.h" #include "src/objects/heap-object.h" #include "src/objects/objects.h" #include "torque-generated/field-offsets-tq.h" // Has to be the last include (doesn't have include guards): #include "src/objects/object-macros.h" namespace v8 { namespace internal { enum InstanceType : uint16_t; #define DATA_ONLY_VISITOR_ID_LIST(V) \ V(BigInt) \ V(ByteArray) \ V(DataObject) \ V(FixedDoubleArray) \ V(SeqOneByteString) \ V(SeqTwoByteString) #define POINTER_VISITOR_ID_LIST(V) \ V(AllocationSite) \ V(BytecodeArray) \ V(Cell) \ V(Code) \ V(CodeDataContainer) \ V(ConsString) \ V(Context) \ V(DataHandler) \ V(DescriptorArray) \ V(EmbedderDataArray) \ V(EphemeronHashTable) \ V(FeedbackCell) \ V(FeedbackVector) \ V(FixedArray) \ V(FreeSpace) \ V(JSApiObject) \ V(JSArrayBuffer) \ V(JSDataView) \ V(JSFunction) \ V(JSObject) \ V(JSObjectFast) \ V(JSTypedArray) \ V(JSWeakRef) \ V(JSWeakCollection) \ V(Map) \ V(NativeContext) \ V(Oddball) \ V(PreparseData) \ V(PropertyArray) \ V(PropertyCell) \ V(PrototypeInfo) \ V(SharedFunctionInfo) \ V(ShortcutCandidate) \ V(SlicedString) \ V(SmallOrderedHashMap) \ V(SmallOrderedHashSet) \ V(SmallOrderedNameDictionary) \ V(SourceTextModule) \ V(Struct) \ V(Symbol) \ V(SyntheticModule) \ V(ThinString) \ V(TransitionArray) \ V(UncompiledDataWithoutPreparseData) \ V(UncompiledDataWithPreparseData) \ V(WasmCapiFunctionData) \ V(WasmIndirectFunctionTable) \ V(WasmInstanceObject) \ V(WeakArray) \ V(WeakCell) // Objects with the same visitor id are processed in the same way by // the heap visitors. The visitor ids for data only objects must precede // other visitor ids. We rely on kDataOnlyVisitorIdCount for quick check // of whether an object contains only data or may contain pointers. enum VisitorId { #define VISITOR_ID_ENUM_DECL(id) kVisit##id, DATA_ONLY_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL) kDataOnlyVisitorIdCount, POINTER_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL) #undef VISITOR_ID_ENUM_DECL kVisitorIdCount }; enum class ObjectFields { kDataOnly, kMaybePointers, }; using MapHandles = std::vector>; // All heap objects have a Map that describes their structure. // A Map contains information about: // - Size information about the object // - How to iterate over an object (for garbage collection) // // Map layout: // +---------------+---------------------------------------------+ // | _ Type _ | _ Description _ | // +---------------+---------------------------------------------+ // | TaggedPointer | map - Always a pointer to the MetaMap root | // +---------------+---------------------------------------------+ // | Int | The first int field | // `---+----------+---------------------------------------------+ // | Byte | [instance_size] | // +----------+---------------------------------------------+ // | Byte | If Map for a primitive type: | // | | native context index for constructor fn | // | | If Map for an Object type: | // | | inobject properties start offset in words | // +----------+---------------------------------------------+ // | Byte | [used_or_unused_instance_size_in_words] | // | | For JSObject in fast mode this byte encodes | // | | the size of the object that includes only | // | | the used property fields or the slack size | // | | in properties backing store. | // +----------+---------------------------------------------+ // | Byte | [visitor_id] | // +----+----------+---------------------------------------------+ // | Int | The second int field | // `---+----------+---------------------------------------------+ // | Short | [instance_type] | // +----------+---------------------------------------------+ // | Byte | [bit_field] | // | | - has_non_instance_prototype (bit 0) | // | | - is_callable (bit 1) | // | | - has_named_interceptor (bit 2) | // | | - has_indexed_interceptor (bit 3) | // | | - is_undetectable (bit 4) | // | | - is_access_check_needed (bit 5) | // | | - is_constructor (bit 6) | // | | - has_prototype_slot (bit 7) | // +----------+---------------------------------------------+ // | Byte | [bit_field2] | // | | - new_target_is_base (bit 0) | // | | - is_immutable_proto (bit 1) | // | | - unused bit (bit 2) | // | | - elements_kind (bits 3..7) | // +----+----------+---------------------------------------------+ // | Int | [bit_field3] | // | | - enum_length (bit 0..9) | // | | - number_of_own_descriptors (bit 10..19) | // | | - is_prototype_map (bit 20) | // | | - is_dictionary_map (bit 21) | // | | - owns_descriptors (bit 22) | // | | - is_in_retained_map_list (bit 23) | // | | - is_deprecated (bit 24) | // | | - is_unstable (bit 25) | // | | - is_migration_target (bit 26) | // | | - is_extensible (bit 28) | // | | - may_have_interesting_symbols (bit 28) | // | | - construction_counter (bit 29..31) | // | | | // +*************************************************************+ // | Int | On systems with 64bit pointer types, there | // | | is an unused 32bits after bit_field3 | // +*************************************************************+ // | TaggedPointer | [prototype] | // +---------------+---------------------------------------------+ // | TaggedPointer | [constructor_or_backpointer] | // +---------------+---------------------------------------------+ // | TaggedPointer | [instance_descriptors] | // +*************************************************************+ // ! TaggedPointer ! [layout_descriptors] ! // ! ! Field is only present if compile-time flag ! // ! ! FLAG_unbox_double_fields is enabled ! // ! ! (basically on 64 bit architectures) ! // +*************************************************************+ // | TaggedPointer | [dependent_code] | // +---------------+---------------------------------------------+ // | TaggedPointer | [prototype_validity_cell] | // +---------------+---------------------------------------------+ // | TaggedPointer | If Map is a prototype map: | // | | [prototype_info] | // | | Else: | // | | [raw_transitions] | // +---------------+---------------------------------------------+ class Map : public HeapObject { public: // Instance size. // Size in bytes or kVariableSizeSentinel if instances do not have // a fixed size. DECL_INT_ACCESSORS(instance_size) // Size in words or kVariableSizeSentinel if instances do not have // a fixed size. DECL_INT_ACCESSORS(instance_size_in_words) // [inobject_properties_start_or_constructor_function_index]: // Provides access to the inobject properties start offset in words in case of // JSObject maps, or the constructor function index in case of primitive maps. DECL_INT_ACCESSORS(inobject_properties_start_or_constructor_function_index) // Get/set the in-object property area start offset in words in the object. inline int GetInObjectPropertiesStartInWords() const; inline void SetInObjectPropertiesStartInWords(int value); // Count of properties allocated in the object (JSObject only). inline int GetInObjectProperties() const; // Index of the constructor function in the native context (primitives only), // or the special sentinel value to indicate that there is no object wrapper // for the primitive (i.e. in case of null or undefined). static const int kNoConstructorFunctionIndex = 0; inline int GetConstructorFunctionIndex() const; inline void SetConstructorFunctionIndex(int value); static MaybeHandle GetConstructorFunction( Handle map, Handle native_context); // Retrieve interceptors. DECL_GETTER(GetNamedInterceptor, InterceptorInfo) DECL_GETTER(GetIndexedInterceptor, InterceptorInfo) // Instance type. DECL_PRIMITIVE_ACCESSORS(instance_type, InstanceType) // Returns the size of the used in-object area including object header // (only used for JSObject in fast mode, for the other kinds of objects it // is equal to the instance size). inline int UsedInstanceSize() const; // Tells how many unused property fields (in-object or out-of object) are // available in the instance (only used for JSObject in fast mode). inline int UnusedPropertyFields() const; // Tells how many unused in-object property words are present. inline int UnusedInObjectProperties() const; // Updates the counters tracking unused fields in the object. inline void SetInObjectUnusedPropertyFields(int unused_property_fields); // Updates the counters tracking unused fields in the property array. inline void SetOutOfObjectUnusedPropertyFields(int unused_property_fields); inline void CopyUnusedPropertyFields(Map map); inline void CopyUnusedPropertyFieldsAdjustedForInstanceSize(Map map); inline void AccountAddedPropertyField(); inline void AccountAddedOutOfObjectPropertyField( int unused_in_property_array); // // Bit field. // DECL_PRIMITIVE_ACCESSORS(bit_field, byte) // Atomic accessors, used for whitelisting legitimate concurrent accesses. DECL_PRIMITIVE_ACCESSORS(relaxed_bit_field, byte) // Bit positions for |bit_field|. #define MAP_BIT_FIELD_FIELDS(V, _) \ V(HasNonInstancePrototypeBit, bool, 1, _) \ V(IsCallableBit, bool, 1, _) \ V(HasNamedInterceptorBit, bool, 1, _) \ V(HasIndexedInterceptorBit, bool, 1, _) \ V(IsUndetectableBit, bool, 1, _) \ V(IsAccessCheckNeededBit, bool, 1, _) \ V(IsConstructorBit, bool, 1, _) \ V(HasPrototypeSlotBit, bool, 1, _) DEFINE_BIT_FIELDS(MAP_BIT_FIELD_FIELDS) #undef MAP_BIT_FIELD_FIELDS // // Bit field 2. // DECL_PRIMITIVE_ACCESSORS(bit_field2, byte) // Bit positions for |bit_field2|. #define MAP_BIT_FIELD2_FIELDS(V, _) \ V(NewTargetIsBaseBit, bool, 1, _) \ V(IsImmutablePrototypeBit, bool, 1, _) \ V(UnusedBit, bool, 1, _) \ V(ElementsKindBits, ElementsKind, 5, _) DEFINE_BIT_FIELDS(MAP_BIT_FIELD2_FIELDS) #undef MAP_BIT_FIELD2_FIELDS // // Bit field 3. // DECL_PRIMITIVE_ACCESSORS(bit_field3, uint32_t) // Clear uninitialized padding space. This ensures that the snapshot content // is deterministic. Depending on the V8 build mode there could be no padding. V8_INLINE void clear_padding(); // Bit positions for |bit_field3|. #define MAP_BIT_FIELD3_FIELDS(V, _) \ V(EnumLengthBits, int, kDescriptorIndexBitCount, _) \ V(NumberOfOwnDescriptorsBits, int, kDescriptorIndexBitCount, _) \ V(IsPrototypeMapBit, bool, 1, _) \ V(IsDictionaryMapBit, bool, 1, _) \ V(OwnsDescriptorsBit, bool, 1, _) \ V(IsInRetainedMapListBit, bool, 1, _) \ V(IsDeprecatedBit, bool, 1, _) \ V(IsUnstableBit, bool, 1, _) \ V(IsMigrationTargetBit, bool, 1, _) \ V(IsExtensibleBit, bool, 1, _) \ V(MayHaveInterestingSymbolsBit, bool, 1, _) \ V(ConstructionCounterBits, int, 3, _) DEFINE_BIT_FIELDS(MAP_BIT_FIELD3_FIELDS) #undef MAP_BIT_FIELD3_FIELDS STATIC_ASSERT(NumberOfOwnDescriptorsBits::kMax >= kMaxNumberOfDescriptors); static const int kSlackTrackingCounterStart = 7; static const int kSlackTrackingCounterEnd = 1; static const int kNoSlackTracking = 0; STATIC_ASSERT(kSlackTrackingCounterStart <= ConstructionCounterBits::kMax); // Inobject slack tracking is the way to reclaim unused inobject space. // // The instance size is initially determined by adding some slack to // expected_nof_properties (to allow for a few extra properties added // after the constructor). There is no guarantee that the extra space // will not be wasted. // // Here is the algorithm to reclaim the unused inobject space: // - Detect the first constructor call for this JSFunction. // When it happens enter the "in progress" state: initialize construction // counter in the initial_map. // - While the tracking is in progress initialize unused properties of a new // object with one_pointer_filler_map instead of undefined_value (the "used" // part is initialized with undefined_value as usual). This way they can // be resized quickly and safely. // - Once enough objects have been created compute the 'slack' // (traverse the map transition tree starting from the // initial_map and find the lowest value of unused_property_fields). // - Traverse the transition tree again and decrease the instance size // of every map. Existing objects will resize automatically (they are // filled with one_pointer_filler_map). All further allocations will // use the adjusted instance size. // - SharedFunctionInfo's expected_nof_properties left unmodified since // allocations made using different closures could actually create different // kind of objects (see prototype inheritance pattern). // // Important: inobject slack tracking is not attempted during the snapshot // creation. static const int kGenerousAllocationCount = kSlackTrackingCounterStart - kSlackTrackingCounterEnd + 1; // Starts the tracking by initializing object constructions countdown counter. void StartInobjectSlackTracking(); // True if the object constructions countdown counter is a range // [kSlackTrackingCounterEnd, kSlackTrackingCounterStart]. inline bool IsInobjectSlackTrackingInProgress() const; // Does the tracking step. inline void InobjectSlackTrackingStep(Isolate* isolate); // Computes inobject slack for the transition tree starting at this initial // map. int ComputeMinObjectSlack(Isolate* isolate); inline int InstanceSizeFromSlack(int slack) const; // Completes inobject slack tracking for the transition tree starting at this // initial map. V8_EXPORT_PRIVATE void CompleteInobjectSlackTracking(Isolate* isolate); // Tells whether the object in the prototype property will be used // for instances created from this function. If the prototype // property is set to a value that is not a JSObject, the prototype // property will not be used to create instances of the function. // See ECMA-262, 13.2.2. DECL_BOOLEAN_ACCESSORS(has_non_instance_prototype) // Tells whether the instance has a [[Construct]] internal method. // This property is implemented according to ES6, section 7.2.4. DECL_BOOLEAN_ACCESSORS(is_constructor) // Tells whether the instance with this map may have properties for // interesting symbols on it. // An "interesting symbol" is one for which Name::IsInterestingSymbol() // returns true, i.e. a well-known symbol like @@toStringTag. DECL_BOOLEAN_ACCESSORS(may_have_interesting_symbols) DECL_BOOLEAN_ACCESSORS(has_prototype_slot) // Records and queries whether the instance has a named interceptor. DECL_BOOLEAN_ACCESSORS(has_named_interceptor) // Records and queries whether the instance has an indexed interceptor. DECL_BOOLEAN_ACCESSORS(has_indexed_interceptor) // Tells whether the instance is undetectable. // An undetectable object is a special class of JSObject: 'typeof' operator // returns undefined, ToBoolean returns false. Otherwise it behaves like // a normal JS object. It is useful for implementing undetectable // document.all in Firefox & Safari. // See https://bugzilla.mozilla.org/show_bug.cgi?id=248549. DECL_BOOLEAN_ACCESSORS(is_undetectable) // Tells whether the instance has a [[Call]] internal method. // This property is implemented according to ES6, section 7.2.3. DECL_BOOLEAN_ACCESSORS(is_callable) DECL_BOOLEAN_ACCESSORS(new_target_is_base) DECL_BOOLEAN_ACCESSORS(is_extensible) DECL_BOOLEAN_ACCESSORS(is_prototype_map) inline bool is_abandoned_prototype_map() const; // Whether the instance has been added to the retained map list by // Heap::AddRetainedMap. DECL_BOOLEAN_ACCESSORS(is_in_retained_map_list) DECL_PRIMITIVE_ACCESSORS(elements_kind, ElementsKind) // Tells whether the instance has fast elements that are only Smis. inline bool has_fast_smi_elements() const; // Tells whether the instance has fast elements. inline bool has_fast_object_elements() const; inline bool has_fast_smi_or_object_elements() const; inline bool has_fast_double_elements() const; inline bool has_fast_elements() const; inline bool has_sloppy_arguments_elements() const; inline bool has_fast_sloppy_arguments_elements() const; inline bool has_fast_string_wrapper_elements() const; inline bool has_typed_array_elements() const; inline bool has_dictionary_elements() const; inline bool has_any_nonextensible_elements() const; inline bool has_nonextensible_elements() const; inline bool has_sealed_elements() const; inline bool has_frozen_elements() const; // Returns true if the current map doesn't have DICTIONARY_ELEMENTS but if a // map with DICTIONARY_ELEMENTS was found in the prototype chain. bool DictionaryElementsInPrototypeChainOnly(Isolate* isolate); inline Map ElementsTransitionMap(Isolate* isolate); inline FixedArrayBase GetInitialElements() const; // [raw_transitions]: Provides access to the transitions storage field. // Don't call set_raw_transitions() directly to overwrite transitions, use // the TransitionArray::ReplaceTransitions() wrapper instead! DECL_ACCESSORS(raw_transitions, MaybeObject) // [prototype_info]: Per-prototype metadata. Aliased with transitions // (which prototype maps don't have). DECL_ACCESSORS(prototype_info, Object) // PrototypeInfo is created lazily using this helper (which installs it on // the given prototype's map). static Handle GetOrCreatePrototypeInfo( Handle prototype, Isolate* isolate); static Handle GetOrCreatePrototypeInfo( Handle prototype_map, Isolate* isolate); inline bool should_be_fast_prototype_map() const; static void SetShouldBeFastPrototypeMap(Handle map, bool value, Isolate* isolate); // [prototype chain validity cell]: Associated with a prototype object, // stored in that object's map, indicates that prototype chains through this // object are currently valid. The cell will be invalidated and replaced when // the prototype chain changes. When there's nothing to guard (for example, // when direct prototype is null or Proxy) this function returns Smi with // |kPrototypeChainValid| sentinel value. static Handle