Emily Bernier | d0a1eb7 | 2015-03-24 16:35:39 -0400 | [diff] [blame] | 1 | // Copyright 2014 the V8 project authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
| 5 | #include "src/v8.h" |
| 6 | |
| 7 | #include "src/allocation-site-scopes.h" |
| 8 | #include "src/arguments.h" |
| 9 | #include "src/ast.h" |
| 10 | #include "src/parser.h" |
| 11 | #include "src/runtime/runtime.h" |
| 12 | #include "src/runtime/runtime-utils.h" |
| 13 | |
| 14 | namespace v8 { |
| 15 | namespace internal { |
| 16 | |
| 17 | static Handle<Map> ComputeObjectLiteralMap( |
| 18 | Handle<Context> context, Handle<FixedArray> constant_properties, |
| 19 | bool* is_result_from_cache) { |
| 20 | int properties_length = constant_properties->length(); |
| 21 | int number_of_properties = properties_length / 2; |
| 22 | |
| 23 | for (int p = 0; p != properties_length; p += 2) { |
| 24 | Object* key = constant_properties->get(p); |
| 25 | uint32_t element_index = 0; |
| 26 | if (key->ToArrayIndex(&element_index)) { |
| 27 | // An index key does not require space in the property backing store. |
| 28 | number_of_properties--; |
| 29 | } |
| 30 | } |
| 31 | Isolate* isolate = context->GetIsolate(); |
| 32 | return isolate->factory()->ObjectLiteralMapFromCache( |
| 33 | context, number_of_properties, is_result_from_cache); |
| 34 | } |
| 35 | |
| 36 | MUST_USE_RESULT static MaybeHandle<Object> CreateLiteralBoilerplate( |
| 37 | Isolate* isolate, Handle<FixedArray> literals, |
| 38 | Handle<FixedArray> constant_properties); |
| 39 | |
| 40 | |
| 41 | MUST_USE_RESULT static MaybeHandle<Object> CreateObjectLiteralBoilerplate( |
| 42 | Isolate* isolate, Handle<FixedArray> literals, |
| 43 | Handle<FixedArray> constant_properties, bool should_have_fast_elements, |
| 44 | bool has_function_literal) { |
| 45 | // Get the native context from the literals array. This is the |
| 46 | // context in which the function was created and we use the object |
| 47 | // function from this context to create the object literal. We do |
| 48 | // not use the object function from the current native context |
| 49 | // because this might be the object function from another context |
| 50 | // which we should not have access to. |
| 51 | Handle<Context> context = |
| 52 | Handle<Context>(JSFunction::NativeContextFromLiterals(*literals)); |
| 53 | |
| 54 | // In case we have function literals, we want the object to be in |
| 55 | // slow properties mode for now. We don't go in the map cache because |
| 56 | // maps with constant functions can't be shared if the functions are |
| 57 | // not the same (which is the common case). |
| 58 | bool is_result_from_cache = false; |
| 59 | Handle<Map> map = has_function_literal |
| 60 | ? Handle<Map>(context->object_function()->initial_map()) |
| 61 | : ComputeObjectLiteralMap(context, constant_properties, |
| 62 | &is_result_from_cache); |
| 63 | |
| 64 | PretenureFlag pretenure_flag = |
| 65 | isolate->heap()->InNewSpace(*literals) ? NOT_TENURED : TENURED; |
| 66 | |
| 67 | Handle<JSObject> boilerplate = |
| 68 | isolate->factory()->NewJSObjectFromMap(map, pretenure_flag); |
| 69 | |
| 70 | // Normalize the elements of the boilerplate to save space if needed. |
| 71 | if (!should_have_fast_elements) JSObject::NormalizeElements(boilerplate); |
| 72 | |
| 73 | // Add the constant properties to the boilerplate. |
| 74 | int length = constant_properties->length(); |
| 75 | bool should_transform = |
| 76 | !is_result_from_cache && boilerplate->HasFastProperties(); |
| 77 | bool should_normalize = should_transform || has_function_literal; |
| 78 | if (should_normalize) { |
| 79 | // TODO(verwaest): We might not want to ever normalize here. |
| 80 | JSObject::NormalizeProperties(boilerplate, KEEP_INOBJECT_PROPERTIES, |
| 81 | length / 2, "Boilerplate"); |
| 82 | } |
| 83 | // TODO(verwaest): Support tracking representations in the boilerplate. |
| 84 | for (int index = 0; index < length; index += 2) { |
| 85 | Handle<Object> key(constant_properties->get(index + 0), isolate); |
| 86 | Handle<Object> value(constant_properties->get(index + 1), isolate); |
| 87 | if (value->IsFixedArray()) { |
| 88 | // The value contains the constant_properties of a |
| 89 | // simple object or array literal. |
| 90 | Handle<FixedArray> array = Handle<FixedArray>::cast(value); |
| 91 | ASSIGN_RETURN_ON_EXCEPTION( |
| 92 | isolate, value, CreateLiteralBoilerplate(isolate, literals, array), |
| 93 | Object); |
| 94 | } |
| 95 | MaybeHandle<Object> maybe_result; |
| 96 | uint32_t element_index = 0; |
| 97 | if (key->IsInternalizedString()) { |
| 98 | if (Handle<String>::cast(key)->AsArrayIndex(&element_index)) { |
| 99 | // Array index as string (uint32). |
| 100 | if (value->IsUninitialized()) value = handle(Smi::FromInt(0), isolate); |
| 101 | maybe_result = |
| 102 | JSObject::SetOwnElement(boilerplate, element_index, value, SLOPPY); |
| 103 | } else { |
| 104 | Handle<String> name(String::cast(*key)); |
| 105 | DCHECK(!name->AsArrayIndex(&element_index)); |
| 106 | maybe_result = JSObject::SetOwnPropertyIgnoreAttributes( |
| 107 | boilerplate, name, value, NONE); |
| 108 | } |
| 109 | } else if (key->ToArrayIndex(&element_index)) { |
| 110 | // Array index (uint32). |
| 111 | if (value->IsUninitialized()) value = handle(Smi::FromInt(0), isolate); |
| 112 | maybe_result = |
| 113 | JSObject::SetOwnElement(boilerplate, element_index, value, SLOPPY); |
| 114 | } else { |
| 115 | // Non-uint32 number. |
| 116 | DCHECK(key->IsNumber()); |
| 117 | double num = key->Number(); |
| 118 | char arr[100]; |
| 119 | Vector<char> buffer(arr, arraysize(arr)); |
| 120 | const char* str = DoubleToCString(num, buffer); |
| 121 | Handle<String> name = isolate->factory()->NewStringFromAsciiChecked(str); |
| 122 | maybe_result = JSObject::SetOwnPropertyIgnoreAttributes(boilerplate, name, |
| 123 | value, NONE); |
| 124 | } |
| 125 | // If setting the property on the boilerplate throws an |
| 126 | // exception, the exception is converted to an empty handle in |
| 127 | // the handle based operations. In that case, we need to |
| 128 | // convert back to an exception. |
| 129 | RETURN_ON_EXCEPTION(isolate, maybe_result, Object); |
| 130 | } |
| 131 | |
| 132 | // Transform to fast properties if necessary. For object literals with |
| 133 | // containing function literals we defer this operation until after all |
| 134 | // computed properties have been assigned so that we can generate |
| 135 | // constant function properties. |
| 136 | if (should_transform && !has_function_literal) { |
| 137 | JSObject::MigrateSlowToFast(boilerplate, |
| 138 | boilerplate->map()->unused_property_fields(), |
| 139 | "FastLiteral"); |
| 140 | } |
| 141 | return boilerplate; |
| 142 | } |
| 143 | |
| 144 | |
| 145 | MaybeHandle<Object> Runtime::CreateArrayLiteralBoilerplate( |
| 146 | Isolate* isolate, Handle<FixedArray> literals, |
| 147 | Handle<FixedArray> elements) { |
| 148 | // Create the JSArray. |
| 149 | Handle<JSFunction> constructor( |
| 150 | JSFunction::NativeContextFromLiterals(*literals)->array_function()); |
| 151 | |
| 152 | PretenureFlag pretenure_flag = |
| 153 | isolate->heap()->InNewSpace(*literals) ? NOT_TENURED : TENURED; |
| 154 | |
| 155 | Handle<JSArray> object = Handle<JSArray>::cast( |
| 156 | isolate->factory()->NewJSObject(constructor, pretenure_flag)); |
| 157 | |
| 158 | ElementsKind constant_elements_kind = |
| 159 | static_cast<ElementsKind>(Smi::cast(elements->get(0))->value()); |
| 160 | Handle<FixedArrayBase> constant_elements_values( |
| 161 | FixedArrayBase::cast(elements->get(1))); |
| 162 | |
| 163 | { |
| 164 | DisallowHeapAllocation no_gc; |
| 165 | DCHECK(IsFastElementsKind(constant_elements_kind)); |
| 166 | Context* native_context = isolate->context()->native_context(); |
| 167 | Object* maps_array = native_context->js_array_maps(); |
| 168 | DCHECK(!maps_array->IsUndefined()); |
| 169 | Object* map = FixedArray::cast(maps_array)->get(constant_elements_kind); |
| 170 | object->set_map(Map::cast(map)); |
| 171 | } |
| 172 | |
| 173 | Handle<FixedArrayBase> copied_elements_values; |
| 174 | if (IsFastDoubleElementsKind(constant_elements_kind)) { |
| 175 | copied_elements_values = isolate->factory()->CopyFixedDoubleArray( |
| 176 | Handle<FixedDoubleArray>::cast(constant_elements_values)); |
| 177 | } else { |
| 178 | DCHECK(IsFastSmiOrObjectElementsKind(constant_elements_kind)); |
| 179 | const bool is_cow = (constant_elements_values->map() == |
| 180 | isolate->heap()->fixed_cow_array_map()); |
| 181 | if (is_cow) { |
| 182 | copied_elements_values = constant_elements_values; |
| 183 | #if DEBUG |
| 184 | Handle<FixedArray> fixed_array_values = |
| 185 | Handle<FixedArray>::cast(copied_elements_values); |
| 186 | for (int i = 0; i < fixed_array_values->length(); i++) { |
| 187 | DCHECK(!fixed_array_values->get(i)->IsFixedArray()); |
| 188 | } |
| 189 | #endif |
| 190 | } else { |
| 191 | Handle<FixedArray> fixed_array_values = |
| 192 | Handle<FixedArray>::cast(constant_elements_values); |
| 193 | Handle<FixedArray> fixed_array_values_copy = |
| 194 | isolate->factory()->CopyFixedArray(fixed_array_values); |
| 195 | copied_elements_values = fixed_array_values_copy; |
| 196 | for (int i = 0; i < fixed_array_values->length(); i++) { |
| 197 | if (fixed_array_values->get(i)->IsFixedArray()) { |
| 198 | // The value contains the constant_properties of a |
| 199 | // simple object or array literal. |
| 200 | Handle<FixedArray> fa(FixedArray::cast(fixed_array_values->get(i))); |
| 201 | Handle<Object> result; |
| 202 | ASSIGN_RETURN_ON_EXCEPTION( |
| 203 | isolate, result, CreateLiteralBoilerplate(isolate, literals, fa), |
| 204 | Object); |
| 205 | fixed_array_values_copy->set(i, *result); |
| 206 | } |
| 207 | } |
| 208 | } |
| 209 | } |
| 210 | object->set_elements(*copied_elements_values); |
| 211 | object->set_length(Smi::FromInt(copied_elements_values->length())); |
| 212 | |
| 213 | JSObject::ValidateElements(object); |
| 214 | return object; |
| 215 | } |
| 216 | |
| 217 | |
| 218 | MUST_USE_RESULT static MaybeHandle<Object> CreateLiteralBoilerplate( |
| 219 | Isolate* isolate, Handle<FixedArray> literals, Handle<FixedArray> array) { |
| 220 | Handle<FixedArray> elements = CompileTimeValue::GetElements(array); |
| 221 | const bool kHasNoFunctionLiteral = false; |
| 222 | switch (CompileTimeValue::GetLiteralType(array)) { |
| 223 | case CompileTimeValue::OBJECT_LITERAL_FAST_ELEMENTS: |
| 224 | return CreateObjectLiteralBoilerplate(isolate, literals, elements, true, |
| 225 | kHasNoFunctionLiteral); |
| 226 | case CompileTimeValue::OBJECT_LITERAL_SLOW_ELEMENTS: |
| 227 | return CreateObjectLiteralBoilerplate(isolate, literals, elements, false, |
| 228 | kHasNoFunctionLiteral); |
| 229 | case CompileTimeValue::ARRAY_LITERAL: |
| 230 | return Runtime::CreateArrayLiteralBoilerplate(isolate, literals, |
| 231 | elements); |
| 232 | default: |
| 233 | UNREACHABLE(); |
| 234 | return MaybeHandle<Object>(); |
| 235 | } |
| 236 | } |
| 237 | |
| 238 | |
| 239 | RUNTIME_FUNCTION(Runtime_CreateObjectLiteral) { |
| 240 | HandleScope scope(isolate); |
| 241 | DCHECK(args.length() == 4); |
| 242 | CONVERT_ARG_HANDLE_CHECKED(FixedArray, literals, 0); |
| 243 | CONVERT_SMI_ARG_CHECKED(literals_index, 1); |
| 244 | CONVERT_ARG_HANDLE_CHECKED(FixedArray, constant_properties, 2); |
| 245 | CONVERT_SMI_ARG_CHECKED(flags, 3); |
| 246 | bool should_have_fast_elements = (flags & ObjectLiteral::kFastElements) != 0; |
| 247 | bool has_function_literal = (flags & ObjectLiteral::kHasFunction) != 0; |
| 248 | |
| 249 | RUNTIME_ASSERT(literals_index >= 0 && literals_index < literals->length()); |
| 250 | |
| 251 | // Check if boilerplate exists. If not, create it first. |
| 252 | Handle<Object> literal_site(literals->get(literals_index), isolate); |
| 253 | Handle<AllocationSite> site; |
| 254 | Handle<JSObject> boilerplate; |
| 255 | if (*literal_site == isolate->heap()->undefined_value()) { |
| 256 | Handle<Object> raw_boilerplate; |
| 257 | ASSIGN_RETURN_FAILURE_ON_EXCEPTION( |
| 258 | isolate, raw_boilerplate, |
| 259 | CreateObjectLiteralBoilerplate(isolate, literals, constant_properties, |
| 260 | should_have_fast_elements, |
| 261 | has_function_literal)); |
| 262 | boilerplate = Handle<JSObject>::cast(raw_boilerplate); |
| 263 | |
| 264 | AllocationSiteCreationContext creation_context(isolate); |
| 265 | site = creation_context.EnterNewScope(); |
| 266 | RETURN_FAILURE_ON_EXCEPTION( |
| 267 | isolate, JSObject::DeepWalk(boilerplate, &creation_context)); |
| 268 | creation_context.ExitScope(site, boilerplate); |
| 269 | |
| 270 | // Update the functions literal and return the boilerplate. |
| 271 | literals->set(literals_index, *site); |
| 272 | } else { |
| 273 | site = Handle<AllocationSite>::cast(literal_site); |
| 274 | boilerplate = |
| 275 | Handle<JSObject>(JSObject::cast(site->transition_info()), isolate); |
| 276 | } |
| 277 | |
| 278 | AllocationSiteUsageContext usage_context(isolate, site, true); |
| 279 | usage_context.EnterNewScope(); |
| 280 | MaybeHandle<Object> maybe_copy = |
| 281 | JSObject::DeepCopy(boilerplate, &usage_context); |
| 282 | usage_context.ExitScope(site, boilerplate); |
| 283 | Handle<Object> copy; |
| 284 | ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, copy, maybe_copy); |
| 285 | return *copy; |
| 286 | } |
| 287 | |
| 288 | |
| 289 | MUST_USE_RESULT static MaybeHandle<AllocationSite> GetLiteralAllocationSite( |
| 290 | Isolate* isolate, Handle<FixedArray> literals, int literals_index, |
| 291 | Handle<FixedArray> elements) { |
| 292 | // Check if boilerplate exists. If not, create it first. |
| 293 | Handle<Object> literal_site(literals->get(literals_index), isolate); |
| 294 | Handle<AllocationSite> site; |
| 295 | if (*literal_site == isolate->heap()->undefined_value()) { |
| 296 | DCHECK(*elements != isolate->heap()->empty_fixed_array()); |
| 297 | Handle<Object> boilerplate; |
| 298 | ASSIGN_RETURN_ON_EXCEPTION( |
| 299 | isolate, boilerplate, |
| 300 | Runtime::CreateArrayLiteralBoilerplate(isolate, literals, elements), |
| 301 | AllocationSite); |
| 302 | |
| 303 | AllocationSiteCreationContext creation_context(isolate); |
| 304 | site = creation_context.EnterNewScope(); |
| 305 | if (JSObject::DeepWalk(Handle<JSObject>::cast(boilerplate), |
| 306 | &creation_context).is_null()) { |
| 307 | return Handle<AllocationSite>::null(); |
| 308 | } |
| 309 | creation_context.ExitScope(site, Handle<JSObject>::cast(boilerplate)); |
| 310 | |
| 311 | literals->set(literals_index, *site); |
| 312 | } else { |
| 313 | site = Handle<AllocationSite>::cast(literal_site); |
| 314 | } |
| 315 | |
| 316 | return site; |
| 317 | } |
| 318 | |
| 319 | |
| 320 | static MaybeHandle<JSObject> CreateArrayLiteralImpl(Isolate* isolate, |
| 321 | Handle<FixedArray> literals, |
| 322 | int literals_index, |
| 323 | Handle<FixedArray> elements, |
| 324 | int flags) { |
| 325 | RUNTIME_ASSERT_HANDLIFIED( |
| 326 | literals_index >= 0 && literals_index < literals->length(), JSObject); |
| 327 | Handle<AllocationSite> site; |
| 328 | ASSIGN_RETURN_ON_EXCEPTION( |
| 329 | isolate, site, |
| 330 | GetLiteralAllocationSite(isolate, literals, literals_index, elements), |
| 331 | JSObject); |
| 332 | |
| 333 | bool enable_mementos = (flags & ArrayLiteral::kDisableMementos) == 0; |
| 334 | Handle<JSObject> boilerplate(JSObject::cast(site->transition_info())); |
| 335 | AllocationSiteUsageContext usage_context(isolate, site, enable_mementos); |
| 336 | usage_context.EnterNewScope(); |
| 337 | JSObject::DeepCopyHints hints = (flags & ArrayLiteral::kShallowElements) == 0 |
| 338 | ? JSObject::kNoHints |
| 339 | : JSObject::kObjectIsShallow; |
| 340 | MaybeHandle<JSObject> copy = |
| 341 | JSObject::DeepCopy(boilerplate, &usage_context, hints); |
| 342 | usage_context.ExitScope(site, boilerplate); |
| 343 | return copy; |
| 344 | } |
| 345 | |
| 346 | |
| 347 | RUNTIME_FUNCTION(Runtime_CreateArrayLiteral) { |
| 348 | HandleScope scope(isolate); |
| 349 | DCHECK(args.length() == 4); |
| 350 | CONVERT_ARG_HANDLE_CHECKED(FixedArray, literals, 0); |
| 351 | CONVERT_SMI_ARG_CHECKED(literals_index, 1); |
| 352 | CONVERT_ARG_HANDLE_CHECKED(FixedArray, elements, 2); |
| 353 | CONVERT_SMI_ARG_CHECKED(flags, 3); |
| 354 | |
| 355 | Handle<JSObject> result; |
| 356 | ASSIGN_RETURN_FAILURE_ON_EXCEPTION( |
| 357 | isolate, result, CreateArrayLiteralImpl(isolate, literals, literals_index, |
| 358 | elements, flags)); |
| 359 | return *result; |
| 360 | } |
| 361 | |
| 362 | |
| 363 | RUNTIME_FUNCTION(Runtime_CreateArrayLiteralStubBailout) { |
| 364 | HandleScope scope(isolate); |
| 365 | DCHECK(args.length() == 3); |
| 366 | CONVERT_ARG_HANDLE_CHECKED(FixedArray, literals, 0); |
| 367 | CONVERT_SMI_ARG_CHECKED(literals_index, 1); |
| 368 | CONVERT_ARG_HANDLE_CHECKED(FixedArray, elements, 2); |
| 369 | |
| 370 | Handle<JSObject> result; |
| 371 | ASSIGN_RETURN_FAILURE_ON_EXCEPTION( |
| 372 | isolate, result, |
| 373 | CreateArrayLiteralImpl(isolate, literals, literals_index, elements, |
| 374 | ArrayLiteral::kShallowElements)); |
| 375 | return *result; |
| 376 | } |
| 377 | |
| 378 | |
| 379 | RUNTIME_FUNCTION(Runtime_StoreArrayLiteralElement) { |
| 380 | HandleScope scope(isolate); |
| 381 | RUNTIME_ASSERT(args.length() == 5); |
| 382 | CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0); |
| 383 | CONVERT_SMI_ARG_CHECKED(store_index, 1); |
| 384 | CONVERT_ARG_HANDLE_CHECKED(Object, value, 2); |
| 385 | CONVERT_ARG_HANDLE_CHECKED(FixedArray, literals, 3); |
| 386 | CONVERT_SMI_ARG_CHECKED(literal_index, 4); |
| 387 | |
| 388 | Object* raw_literal_cell = literals->get(literal_index); |
| 389 | JSArray* boilerplate = NULL; |
| 390 | if (raw_literal_cell->IsAllocationSite()) { |
| 391 | AllocationSite* site = AllocationSite::cast(raw_literal_cell); |
| 392 | boilerplate = JSArray::cast(site->transition_info()); |
| 393 | } else { |
| 394 | boilerplate = JSArray::cast(raw_literal_cell); |
| 395 | } |
| 396 | Handle<JSArray> boilerplate_object(boilerplate); |
| 397 | ElementsKind elements_kind = object->GetElementsKind(); |
| 398 | DCHECK(IsFastElementsKind(elements_kind)); |
| 399 | // Smis should never trigger transitions. |
| 400 | DCHECK(!value->IsSmi()); |
| 401 | |
| 402 | if (value->IsNumber()) { |
| 403 | DCHECK(IsFastSmiElementsKind(elements_kind)); |
| 404 | ElementsKind transitioned_kind = IsFastHoleyElementsKind(elements_kind) |
| 405 | ? FAST_HOLEY_DOUBLE_ELEMENTS |
| 406 | : FAST_DOUBLE_ELEMENTS; |
| 407 | if (IsMoreGeneralElementsKindTransition( |
| 408 | boilerplate_object->GetElementsKind(), transitioned_kind)) { |
| 409 | JSObject::TransitionElementsKind(boilerplate_object, transitioned_kind); |
| 410 | } |
| 411 | JSObject::TransitionElementsKind(object, transitioned_kind); |
| 412 | DCHECK(IsFastDoubleElementsKind(object->GetElementsKind())); |
| 413 | FixedDoubleArray* double_array = FixedDoubleArray::cast(object->elements()); |
| 414 | HeapNumber* number = HeapNumber::cast(*value); |
| 415 | double_array->set(store_index, number->Number()); |
| 416 | } else { |
| 417 | if (!IsFastObjectElementsKind(elements_kind)) { |
| 418 | ElementsKind transitioned_kind = IsFastHoleyElementsKind(elements_kind) |
| 419 | ? FAST_HOLEY_ELEMENTS |
| 420 | : FAST_ELEMENTS; |
| 421 | JSObject::TransitionElementsKind(object, transitioned_kind); |
| 422 | ElementsKind boilerplate_elements_kind = |
| 423 | boilerplate_object->GetElementsKind(); |
| 424 | if (IsMoreGeneralElementsKindTransition(boilerplate_elements_kind, |
| 425 | transitioned_kind)) { |
| 426 | JSObject::TransitionElementsKind(boilerplate_object, transitioned_kind); |
| 427 | } |
| 428 | } |
| 429 | FixedArray* object_array = FixedArray::cast(object->elements()); |
| 430 | object_array->set(store_index, *value); |
| 431 | } |
| 432 | return *object; |
| 433 | } |
| 434 | } |
| 435 | } // namespace v8::internal |