1/*
2 * Copyright (C) 2012-2019 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29#pragma once
30
31#include "ConcurrentJSLock.h"
32#include "JSObject.h"
33#include "JSSymbolTableObject.h"
34#include "SymbolTable.h"
35#include <wtf/SegmentedVector.h>
36
37namespace JSC {
38
39class LLIntOffsetsExtractor;
40
41// This is a mostly drop-in replacement for JSLexicalEnvironment, except that it preserves
42// the invariant that after a variable is created, its address in memory will not change
43// so long as the JSSegmentedVariableObject is alive. This allows optimizations based
44// on getting the address of the variable and remembering it. As well, unlike a
45// JSLexicalEnvironment, this will manage the memory for the registers itself and neither
46// requires nor allows for the subclasses to manage that memory. Finally,
47// JSSegmentedVariableObject has its own GC tracing functionality, since it knows the
48// exact dimensions of the variables array at all times.
49
50class JSSegmentedVariableObject : public JSSymbolTableObject {
51 friend class JIT;
52 friend class LLIntOffsetsExtractor;
53
54public:
55 using Base = JSSymbolTableObject;
56
57 DECLARE_INFO;
58
59 static const bool needsDestruction = true;
60
61 template<typename CellType, SubspaceAccess>
62 static CompleteSubspace* subspaceFor(VM& vm)
63 {
64 return &vm.cellSpace;
65 }
66
67 bool isValidScopeOffset(ScopeOffset offset)
68 {
69 return !!offset && offset.offset() < m_variables.size();
70 }
71
72 // This is not thread-safe, since m_variables is a segmented vector, and its spine can resize with
73 // malloc/free if new variables - unrelated to the one you are accessing - are added. You can get
74 // around this by grabbing m_lock, or finding some other way to get to the variable pointer (global
75 // variable access bytecode instructions will have a direct pointer already).
76 WriteBarrier<Unknown>& variableAt(ScopeOffset offset) { return m_variables[offset.offset()]; }
77
78 // This is a slow method call, which searches the register bank to find the index
79 // given a pointer. It will CRASH() if it does not find the register. Only use this
80 // in debug code (like bytecode dumping).
81 JS_EXPORT_PRIVATE ScopeOffset findVariableIndex(void*);
82
83 WriteBarrier<Unknown>* assertVariableIsInThisObject(WriteBarrier<Unknown>* variablePointer)
84 {
85 if (!ASSERT_DISABLED)
86 findVariableIndex(variablePointer);
87 return variablePointer;
88 }
89
90 // Adds numberOfRegistersToAdd registers, initializes them to Undefined, and returns
91 // the index of the first one added.
92 JS_EXPORT_PRIVATE ScopeOffset addVariables(unsigned numberOfVariablesToAdd, JSValue);
93
94 JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
95 JS_EXPORT_PRIVATE static void heapSnapshot(JSCell*, HeapSnapshotBuilder&);
96
97 static void destroy(JSCell*);
98
99 const ClassInfo* classInfo() const { return m_classInfo; }
100
101protected:
102 JSSegmentedVariableObject(VM&, Structure*, JSScope*);
103
104 ~JSSegmentedVariableObject();
105
106 void finishCreation(VM&);
107
108private:
109 SegmentedVector<WriteBarrier<Unknown>, 16> m_variables;
110 const ClassInfo* m_classInfo;
111#ifndef NDEBUG
112 bool m_alreadyDestroyed { false }; // We use these assertions to check that we aren't doing ancient hacks that result in this being destroyed more than once.
113#endif
114};
115
116} // namespace JSC
117