/*

* Copyright (C) 1999-2001 Harri Porten (porten@kde.org)

* Copyright (C) 2001 Peter Kelly (pmk@post.com)

* Copyright (C) 2003-2024 Apple Inc. All rights reserved.

*

* This library is free software; you can redistribute it and/or

* modify it under the terms of the GNU Library General Public

* License as published by the Free Software Foundation; either

* version 2 of the License, or (at your option) any later version.

*

* This library is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

* Library General Public License for more details.

*

* You should have received a copy of the GNU Library General Public License

* along with this library; see the file COPYING.LIB. If not, write to

* the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,

* Boston, MA 02110-1301, USA.

*

*/

#pragma once

#include <JavaScriptCore/ArrayConventions.h>

#include <JavaScriptCore/ArrayStorage.h>

#include <JavaScriptCore/Butterfly.h>

#include <JavaScriptCore/CagedBarrierPtr.h>

#include <JavaScriptCore/ClassInfo.h>

#include <JavaScriptCore/CustomGetterSetter.h>

#include <JavaScriptCore/DOMAttributeGetterSetter.h>

#include <JavaScriptCore/DeletePropertySlot.h>

#include <JavaScriptCore/Heap.h>

#include <JavaScriptCore/IndexingHeaderInlines.h>

#include <JavaScriptCore/Intrinsic.h>

#include <JavaScriptCore/JSCJSValueCell.h>

#include <JavaScriptCore/JSCast.h>

#include <JavaScriptCore/MathCommon.h>

#include <JavaScriptCore/PropertySlot.h>

#include <JavaScriptCore/PropertyStorage.h>

#include <JavaScriptCore/PutDirectIndexMode.h>

#include <JavaScriptCore/PutPropertySlot.h>

#include <JavaScriptCore/Structure.h>

#include <JavaScriptCore/StructureTransitionTable.h>

#include <wtf/StdLibExtras.h>

WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN

namespace JSC {

namespace DOMJIT {

class Signature;

}

inline JSCell* getJSFunction(JSValue); // Defined in JSObjectInlines.h

class ArrayProfile;

class Exception;

class GetterSetter;

class InternalFunction;

class JSFunction;

class JSString;

class LLIntOffsetsExtractor;

class MarkedBlock;

class ObjectInitializationScope;

class PropertyDescriptor;

class PropertyNameArrayBuilder;

class Structure;

class ThrowScope;

class VM;

struct HashTable;

struct HashTableValue;

JS_EXPORT_PRIVATE Exception* throwTypeError(JSGlobalObject*, ThrowScope&, const String&);

extern JS_EXPORT_PRIVATE const ASCIILiteral NonExtensibleObjectPropertyDefineError;

extern JS_EXPORT_PRIVATE const ASCIILiteral ReadonlyPropertyWriteError;

extern JS_EXPORT_PRIVATE const ASCIILiteral ReadonlyPropertyChangeError;

extern JS_EXPORT_PRIVATE const ASCIILiteral UnableToDeletePropertyError;

extern JS_EXPORT_PRIVATE const ASCIILiteral UnconfigurablePropertyChangeAccessMechanismError;

extern JS_EXPORT_PRIVATE const ASCIILiteral UnconfigurablePropertyChangeConfigurabilityError;

extern JS_EXPORT_PRIVATE const ASCIILiteral UnconfigurablePropertyChangeEnumerabilityError;

extern JS_EXPORT_PRIVATE const ASCIILiteral UnconfigurablePropertyChangeWritabilityError;

extern JS_EXPORT_PRIVATE const ASCIILiteral PrototypeValueCanOnlyBeAnObjectOrNullTypeError;

class JSFinalObject;

#if ASSERT_ENABLED

#define JS_EXPORT_PRIVATE_IF_ASSERT_ENABLED JS_EXPORT_PRIVATE

#else

#define JS_EXPORT_PRIVATE_IF_ASSERT_ENABLED

#endif

class JSObject : public JSCell {

friend class BatchedTransitionOptimizer;

friend class JIT;

friend class JSCell;

friend class JSFinalObject;

friend class JSObjectWithButterfly;

friend class MarkedBlock;

enum PutMode : uint8_t {

PutModePut,

PutModeDefineOwnProperty,

};

public:

using Base = JSCell;

DECLARE_VISIT_CHILDREN_WITH_MODIFIER(JS_EXPORT_PRIVATE);

JS_EXPORT_PRIVATE static size_t estimatedSize(JSCell*, VM&);

JS_EXPORT_PRIVATE static void analyzeHeap(JSCell*, HeapAnalyzer&);

JS_EXPORT_PRIVATE static String calculatedClassName(JSObject*);

// This is the fully virtual [[GetPrototypeOf]] internal function defined

// in the ECMAScript 6 specification. Use this when doing a [[GetPrototypeOf]]

// operation as dictated in the specification.

JSValue getPrototype(JSGlobalObject*);

JS_EXPORT_PRIVATE static JSValue getPrototype(JSObject*, JSGlobalObject*);

// This gets the prototype directly off of the structure. This does not do

// dynamic dispatch on the getPrototype method table method. It is not valid

// to use this when performing a [[GetPrototypeOf]] operation in the specification.

// It is valid to use though when you know that you want to directly get it

// without consulting the method table. This is akin to getting the [[Prototype]]

// internal field directly as described in the specification.

JSValue getPrototypeDirect() const;

// This sets the prototype without checking for cycles and without

// doing dynamic dispatch on [[SetPrototypeOf]] operation in the specification.

// It is not valid to use this when performing a [[SetPrototypeOf]] operation in

// the specification. It is valid to use though when you know that you want to directly

// set it without consulting the method table and when you definitely won't

// introduce a cycle in the prototype chain. This is akin to setting the

// [[Prototype]] internal field directly as described in the specification.

JS_EXPORT_PRIVATE void setPrototypeDirect(VM&, JSValue prototype);

private:

// This is OrdinarySetPrototypeOf in the specification. Section 9.1.2.1

// https://tc39.github.io/ecma262/#sec-ordinarysetprototypeof

JS_EXPORT_PRIVATE bool setPrototypeWithCycleCheck(VM&, JSGlobalObject*, JSValue prototype, bool shouldThrowIfCantSet);

public:

// This is the fully virtual [[SetPrototypeOf]] internal function defined

// in the ECMAScript 6 specification. Use this when doing a [[SetPrototypeOf]]

// operation as dictated in the specification.

bool setPrototype(VM&, JSGlobalObject*, JSValue prototype, bool shouldThrowIfCantSet = false);

JS_EXPORT_PRIVATE static bool setPrototype(JSObject*, JSGlobalObject*, JSValue prototype, bool shouldThrowIfCantSet);

inline bool mayInterceptIndexedAccesses();

inline JSValue get(JSGlobalObject*, PropertyName) const; // Defined in JSObjectInlines.h

inline JSValue get(JSGlobalObject*, unsigned propertyName) const; // Defined in JSObjectInlines.h

JSValue get(JSGlobalObject*, uint64_t propertyName) const;

template<typename T, typename PropertyNameType>

inline T getAs(JSGlobalObject*, PropertyNameType) const; // Defined in JSObjectInlines.h

template<bool checkNullStructure = false>

bool getPropertySlot(JSGlobalObject*, PropertyName, PropertySlot&);

bool getPropertySlot(JSGlobalObject*, unsigned propertyName, PropertySlot&);

bool getPropertySlot(JSGlobalObject*, uint64_t propertyName, PropertySlot&);

template<typename CallbackWhenNoException> typename std::invoke_result<CallbackWhenNoException, bool, PropertySlot&>::type getPropertySlot(JSGlobalObject*, PropertyName, CallbackWhenNoException) const;

template<typename CallbackWhenNoException> typename std::invoke_result<CallbackWhenNoException, bool, PropertySlot&>::type getPropertySlot(JSGlobalObject*, PropertyName, PropertySlot&, CallbackWhenNoException) const;

template<typename PropertyNameType> JSValue getIfPropertyExists(JSGlobalObject*, const PropertyNameType&);

bool noSideEffectMayHaveNonIndexProperty(VM&, PropertyName);

enum class SortMode { Default, Ascending };

template<SortMode mode = SortMode::Default, typename Functor>

void forEachOwnIndexedProperty(JSGlobalObject*, const Functor&);

private:

static bool getOwnPropertySlotImpl(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);

public:

JS_EXPORT_PRIVATE_IF_ASSERT_ENABLED static bool getOwnPropertySlot(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);

JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSObject*, JSGlobalObject*, unsigned propertyName, PropertySlot&);

bool getOwnPropertySlotInline(JSGlobalObject*, PropertyName, PropertySlot&);

// The key difference between this and getOwnPropertySlot is that getOwnPropertySlot

// currently returns incorrect results for the DOM window (with non-own properties)

// being returned. Once this is fixed we should migrate code & remove this method.

JS_EXPORT_PRIVATE bool getOwnPropertyDescriptor(JSGlobalObject*, PropertyName, PropertyDescriptor&);

static bool getPrivateFieldSlot(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);

inline bool hasPrivateField(JSGlobalObject*, PropertyName);

inline bool getPrivateField(JSGlobalObject*, PropertyName, PropertySlot&);

inline void setPrivateField(JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

inline void definePrivateField(JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

inline bool hasPrivateBrand(JSGlobalObject*, JSValue brand);

inline void checkPrivateBrand(JSGlobalObject*, JSValue brand);

inline void setPrivateBrand(JSGlobalObject*, JSValue brand);

unsigned getArrayLength() const

{

if (!hasIndexedProperties(indexingType()))

return 0;

return butterfly()->publicLength();

}

unsigned getVectorLength()

{

if (!hasIndexedProperties(indexingType()))

return 0;

return butterfly()->vectorLength();

}

inline bool canHaveExistingOwnIndexedGetterSetterProperties(); // Defined in RenderObjectInlines.h

// This is only valid after using canPerformFastPropertyEnumerationCommon().

// This code is not checking getOwnPropertySlot override etc.

inline unsigned canHaveExistingOwnIndexedProperties() const; // Defined in RenderObjectInlines.h

static bool putInlineForJSObject(JSCell*, JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

JS_EXPORT_PRIVATE static bool put(JSCell*, JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

static bool NODELETE mightBeSpecialProperty(VM&, JSType, UniquedStringImpl*);

JS_EXPORT_PRIVATE NEVER_INLINE static bool definePropertyOnReceiver(JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

// putByIndex assumes that the receiver is this JSCell object.

JS_EXPORT_PRIVATE static bool putByIndex(JSCell*, JSGlobalObject*, unsigned propertyName, JSValue, bool shouldThrow);

// This performs the ECMAScript Set() operation.

ALWAYS_INLINE bool putByIndexInline(JSGlobalObject* globalObject, unsigned propertyName, JSValue value, bool shouldThrow)

{

VM& vm = getVM(globalObject);

if (trySetIndexQuickly(vm, propertyName, value))

return true;

return methodTable()->putByIndex(this, globalObject, propertyName, value, shouldThrow);

}

ALWAYS_INLINE bool putByIndexInline(JSGlobalObject* globalObject, uint64_t propertyName, JSValue value, bool shouldThrow)

{

VM& vm = getVM(globalObject);

if (propertyName <= MAX_ARRAY_INDEX) [[likely]]

return putByIndexInline(globalObject, static_cast<uint32_t>(propertyName), value, shouldThrow);

ASSERT(propertyName <= maxSafeInteger());

PutPropertySlot slot(this, shouldThrow);

return methodTable()->put(this, globalObject, Identifier::from(vm, propertyName), value, slot);

}

// This is similar to the putDirect* methods:

// - the prototype chain is not consulted

// - accessors are not called.

// - it will ignore extensibility and read-only properties if PutDirectIndexLikePutDirect is passed as the mode (the default).

// This method creates a property with attributes writable, enumerable and configurable all set to true if attributes is zero,

// otherwise, it creates a property with the provided attributes. Semantically, this is performing defineOwnProperty.

bool putDirectIndex(JSGlobalObject* globalObject, unsigned propertyName, JSValue value, unsigned attributes, PutDirectIndexMode mode)

{

ASSERT(!value.isCustomGetterSetterSlow());

auto canSetIndexQuicklyForPutDirect = [&] () -> bool {

switch (indexingMode()) {

case ALL_BLANK_INDEXING_TYPES:

case ALL_UNDECIDED_INDEXING_TYPES:

return false;

case ALL_WRITABLE_INT32_INDEXING_TYPES:

case ALL_WRITABLE_DOUBLE_INDEXING_TYPES:

case ALL_WRITABLE_CONTIGUOUS_INDEXING_TYPES:

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

return propertyName < butterfly()->vectorLength();

default:

if (isCopyOnWrite(indexingMode()))

return false;

RELEASE_ASSERT_NOT_REACHED();

return false;

}

};

if (!attributes && canSetIndexQuicklyForPutDirect()) {

setIndexQuickly(getVM(globalObject), propertyName, value);

return true;

}

return putDirectIndexSlowOrBeyondVectorLength(globalObject, propertyName, value, attributes, mode);

}

// This is semantically equivalent to performing defineOwnProperty(propertyName, {configurable:true, writable:true, enumerable:true, value:value}).

bool putDirectIndex(JSGlobalObject* globalObject, unsigned propertyName, JSValue value)

{

return putDirectIndex(globalObject, propertyName, value, 0, PutDirectIndexLikePutDirect);

}

ALWAYS_INLINE bool putDirectIndex(JSGlobalObject* globalObject, uint64_t propertyName, JSValue value, unsigned attributes, PutDirectIndexMode mode)

{

if (propertyName <= MAX_ARRAY_INDEX) [[likely]]

return putDirectIndex(globalObject, static_cast<uint32_t>(propertyName), value, attributes, mode);

return putDirect(getVM(globalObject), Identifier::from(getVM(globalObject), propertyName), value, attributes);

}

// A generally non-throwing version of putDirect and putDirectIndex.

// However, it's only guaranteed to not throw based on what the receiver is.

// For example, if the receiver is a ProxyObject, this is not guaranteed, since

// it may call into arbitrary JS code. It's the responsibility of the user of

// this API to ensure that the receiver object is a well known type if they

// want to ensure that this won't throw an exception.

JS_EXPORT_PRIVATE bool putDirectMayBeIndex(JSGlobalObject*, PropertyName, JSValue);

bool hasIndexingHeader() const

{

return structure()->hasIndexingHeader(this);

}

bool canGetIndexQuicklyForTypedArray(unsigned) const;

JSValue getIndexQuicklyForTypedArray(unsigned, ArrayProfile* = nullptr) const;

bool canGetIndexQuickly(unsigned i) const

{

const Butterfly* butterfly = this->butterfly();

switch (indexingType()) {

case ALL_BLANK_INDEXING_TYPES:

return canGetIndexQuicklyForTypedArray(i);

case ALL_UNDECIDED_INDEXING_TYPES:

return false;

case ALL_INT32_INDEXING_TYPES:

case ALL_CONTIGUOUS_INDEXING_TYPES:

return i < butterfly->vectorLength() && butterfly->contiguous().at(this, i);

case ALL_DOUBLE_INDEXING_TYPES: {

if (i >= butterfly->vectorLength())

return false;

double value = butterfly->contiguousDouble().at(this, i);

if (value != value)

return false;

return true;

}

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

return i < butterfly->arrayStorage()->vectorLength() && butterfly->arrayStorage()->m_vector[i];

default:

RELEASE_ASSERT_NOT_REACHED();

return false;

}

}

bool canGetIndexQuickly(uint64_t i) const

{

ASSERT(i <= maxSafeInteger());

if (i <= MAX_ARRAY_INDEX) [[likely]]

return canGetIndexQuickly(static_cast<uint32_t>(i));

return false;

}

JSValue getIndexQuickly(unsigned i) const

{

const Butterfly* butterfly = this->butterfly();

switch (indexingType()) {

case ALL_INT32_INDEXING_TYPES:

return jsNumber(butterfly->contiguous().at(this, i).get().asInt32());

case ALL_CONTIGUOUS_INDEXING_TYPES:

return butterfly->contiguous().at(this, i).get();

case ALL_DOUBLE_INDEXING_TYPES:

return JSValue(JSValue::EncodeAsDouble, butterfly->contiguousDouble().at(this, i));

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

return butterfly->arrayStorage()->m_vector[i].get();

case ALL_BLANK_INDEXING_TYPES:

return getIndexQuicklyForTypedArray(i);

default:

RELEASE_ASSERT_NOT_REACHED();

return JSValue();

}

}

// Uses the (optional) array profile to set the m_mayBeLargeTypedArray bit when relevant

JSValue tryGetIndexQuickly(unsigned i, ArrayProfile* arrayProfile = nullptr) const

{

const Butterfly* butterfly = this->butterfly();

switch (indexingType()) {

case ALL_BLANK_INDEXING_TYPES:

if (canGetIndexQuicklyForTypedArray(i))

return getIndexQuicklyForTypedArray(i, arrayProfile);

break;

case ALL_UNDECIDED_INDEXING_TYPES:

break;

case ALL_INT32_INDEXING_TYPES:

if (i < butterfly->publicLength()) {

JSValue result = butterfly->contiguous().at(this, i).get();

ASSERT(result.isInt32() || !result);

return result;

}

break;

case ALL_CONTIGUOUS_INDEXING_TYPES:

if (i < butterfly->publicLength())

return butterfly->contiguous().at(this, i).get();

break;

case ALL_DOUBLE_INDEXING_TYPES: {

if (i >= butterfly->publicLength())

break;

double result = butterfly->contiguousDouble().at(this, i);

if (result != result)

break;

return JSValue(JSValue::EncodeAsDouble, result);

}

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

if (i < butterfly->arrayStorage()->vectorLength())

return butterfly->arrayStorage()->m_vector[i].get();

break;

default:

RELEASE_ASSERT_NOT_REACHED();

break;

}

return JSValue();

}

JSValue tryGetIndexQuickly(uint64_t i) const

{

ASSERT(i <= maxSafeInteger());

if (i <= MAX_ARRAY_INDEX) [[likely]]

return tryGetIndexQuickly(static_cast<uint32_t>(i));

return JSValue();

}

JSValue getDirectIndex(JSGlobalObject* globalObject, unsigned i)

{

if (JSValue result = tryGetIndexQuickly(i))

return result;

PropertySlot slot(this, PropertySlot::InternalMethodType::Get);

if (methodTable()->getOwnPropertySlotByIndex(this, globalObject, i, slot))

return slot.getValue(globalObject, i);

return JSValue();

}

JSValue getIndex(JSGlobalObject* globalObject, uint64_t i) const

{

if (JSValue result = tryGetIndexQuickly(i))

return result;

return get(globalObject, i);

}

void setIndexQuicklyForTypedArray(unsigned, JSValue);

void setIndexQuicklyForArrayStorageIndexingType(VM&, unsigned, JSValue);

// Return true to indicate success

// Use the (optional) array profile to set the m_mayBeLargeTypedArray bit when relevant

bool trySetIndexQuicklyForTypedArray(unsigned, JSValue, ArrayProfile*);

bool trySetIndexQuickly(VM& vm, unsigned i, JSValue v, ArrayProfile* arrayProfile = nullptr)

{

Butterfly* butterfly = this->butterfly();

switch (indexingMode()) {

case ALL_BLANK_INDEXING_TYPES:

return trySetIndexQuicklyForTypedArray(i, v, arrayProfile);

case ALL_UNDECIDED_INDEXING_TYPES:

return false;

case ALL_WRITABLE_INT32_INDEXING_TYPES: {

if (i >= butterfly->vectorLength())

return false;

if (!v.isInt32()) {

convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(vm, i, v);

return true;

}

[[fallthrough]];

}

case ALL_WRITABLE_CONTIGUOUS_INDEXING_TYPES: {

if (i >= butterfly->vectorLength())

return false;

butterfly->contiguous().at(this, i).setWithoutWriteBarrier(v);

if (i >= butterfly->publicLength())

butterfly->setPublicLength(i + 1);

vm.writeBarrier(this, v);

return true;

}

case ALL_WRITABLE_DOUBLE_INDEXING_TYPES: {

if (i >= butterfly->vectorLength())

return false;

if (!v.isNumber()) {

convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);

return true;

}

double value = v.asNumber();

if (value != value) {

convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);

return true;

}

butterfly->contiguousDouble().at(this, i) = value;

if (i >= butterfly->publicLength())

butterfly->setPublicLength(i + 1);

return true;

}

case NonArrayWithArrayStorage:

case ArrayWithArrayStorage:

if (i >= butterfly->vectorLength())

return false;

setIndexQuicklyForArrayStorageIndexingType(vm, i, v);

return true;

case NonArrayWithSlowPutArrayStorage:

case ArrayWithSlowPutArrayStorage:

if (i >= butterfly->arrayStorage()->vectorLength() || !butterfly->arrayStorage()->m_vector[i])

return false;

setIndexQuicklyForArrayStorageIndexingType(vm, i, v);

return true;

default:

RELEASE_ASSERT(isCopyOnWrite(indexingMode()));

return false;

}

}

void setIndexQuickly(VM& vm, unsigned i, JSValue v)

{

Butterfly* butterfly = this->butterfly();

ASSERT(!isCopyOnWrite(indexingMode()));

switch (indexingType()) {

case ALL_INT32_INDEXING_TYPES: {

ASSERT(i < butterfly->vectorLength());

if (!v.isInt32()) {

convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(vm, i, v);

return;

}

[[fallthrough]];

}

case ALL_CONTIGUOUS_INDEXING_TYPES: {

ASSERT(i < butterfly->vectorLength());

butterfly->contiguous().at(this, i).setWithoutWriteBarrier(v);

if (i >= butterfly->publicLength())

butterfly->setPublicLength(i + 1);

vm.writeBarrier(this, v);

break;

}

case ALL_DOUBLE_INDEXING_TYPES: {

ASSERT(i < butterfly->vectorLength());

if (!v.isNumber()) {

convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);

return;

}

double value = v.asNumber();

if (value != value) {

convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);

return;

}

butterfly->contiguousDouble().at(this, i) = value;

if (i >= butterfly->publicLength())

butterfly->setPublicLength(i + 1);

break;

}

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

setIndexQuicklyForArrayStorageIndexingType(vm, i, v);

break;

case ALL_BLANK_INDEXING_TYPES:

setIndexQuicklyForTypedArray(i, v);

break;

default:

RELEASE_ASSERT_NOT_REACHED();

}

}

inline void initializeIndex(ObjectInitializationScope&, unsigned, JSValue); // Defined in JSObjectInlines.h

// NOTE: Clients of this method may call it more than once for any index, and this is supposed

// to work.

ALWAYS_INLINE void initializeIndex(ObjectInitializationScope&, unsigned, JSValue, IndexingType); // Defined in JSObjectInlines.h

inline void initializeIndexWithoutBarrier(ObjectInitializationScope&, unsigned, JSValue); // Defined in JSObjectInlines.h

// This version of initializeIndex is for cases where you know that you will not need any

// barriers. This implies not having any data format conversions.

ALWAYS_INLINE void initializeIndexWithoutBarrier(ObjectInitializationScope&, unsigned, JSValue, IndexingType); // Defined in JSObjectInlines.h

bool hasSparseMap()

{

switch (indexingType()) {

case ALL_BLANK_INDEXING_TYPES:

case ALL_UNDECIDED_INDEXING_TYPES:

case ALL_INT32_INDEXING_TYPES:

case ALL_DOUBLE_INDEXING_TYPES:

case ALL_CONTIGUOUS_INDEXING_TYPES:

return false;

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

return !!butterfly()->arrayStorage()->m_sparseMap;

default:

RELEASE_ASSERT_NOT_REACHED();

return false;

}

}

bool inSparseIndexingMode()

{

switch (indexingType()) {

case ALL_BLANK_INDEXING_TYPES:

case ALL_UNDECIDED_INDEXING_TYPES:

case ALL_INT32_INDEXING_TYPES:

case ALL_DOUBLE_INDEXING_TYPES:

case ALL_CONTIGUOUS_INDEXING_TYPES:

return false;

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

return butterfly()->arrayStorage()->inSparseMode();

default:

RELEASE_ASSERT_NOT_REACHED();

return false;

}

}

void enterDictionaryIndexingMode(VM&);

// putDirect is effectively an unchecked vesion of 'defineOwnProperty':

// - the prototype chain is not consulted

// - accessors are not called.

// - attributes will be respected (after the call the property will exist with the given attributes)

// - the property name is assumed to not be an index.

bool putDirect(VM&, PropertyName, JSValue, unsigned attributes = 0);

bool putDirect(VM&, PropertyName, JSValue, unsigned attributes, PutPropertySlot&);

bool putDirect(VM&, PropertyName, JSValue, PutPropertySlot&);

void putDirectWithoutTransition(VM&, PropertyName, JSValue, unsigned attributes = 0);

bool putDirectNonIndexAccessor(VM&, PropertyName, GetterSetter*, unsigned attributes);

void putDirectNonIndexAccessorWithoutTransition(VM&, PropertyName, GetterSetter*, unsigned attributes);

bool putDirectAccessor(JSGlobalObject*, PropertyName, GetterSetter*, unsigned attributes);

JS_EXPORT_PRIVATE bool putDirectCustomAccessor(VM&, PropertyName, JSValue, unsigned attributes);

void putDirectCustomGetterSetterWithoutTransition(VM&, PropertyName, JSValue, unsigned attributes);

bool putGetter(JSGlobalObject*, PropertyName, JSValue, unsigned attributes);

bool putSetter(JSGlobalObject*, PropertyName, JSValue, unsigned attributes);

JS_EXPORT_PRIVATE bool hasProperty(JSGlobalObject*, PropertyName) const;

JS_EXPORT_PRIVATE bool hasProperty(JSGlobalObject*, unsigned propertyName) const;

bool hasProperty(JSGlobalObject*, uint64_t propertyName) const;

bool hasEnumerableProperty(JSGlobalObject*, PropertyName) const;

bool hasEnumerableProperty(JSGlobalObject*, unsigned propertyName) const;

bool hasOwnProperty(JSGlobalObject*, PropertyName, PropertySlot&) const;

bool hasOwnProperty(JSGlobalObject*, PropertyName) const;

bool hasOwnProperty(JSGlobalObject*, unsigned) const;

JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, JSGlobalObject*, PropertyName, DeletePropertySlot&);

JS_EXPORT_PRIVATE static bool deletePropertyByIndex(JSCell*, JSGlobalObject*, unsigned propertyName);

bool deleteProperty(JSGlobalObject*, PropertyName);

bool deleteProperty(JSGlobalObject*, uint32_t propertyName);

bool deleteProperty(JSGlobalObject*, uint64_t propertyName);

JSValue ordinaryToPrimitive(JSGlobalObject*, PreferredPrimitiveType) const;

JS_EXPORT_PRIVATE bool hasInstance(JSGlobalObject*, JSValue value, JSValue hasInstanceValue);

JS_EXPORT_PRIVATE bool hasInstance(JSGlobalObject*, JSValue);

static bool defaultHasInstance(JSGlobalObject*, JSValue, JSValue prototypeProperty);

static constexpr unsigned maximumPrototypeChainDepth = 40000;

JS_EXPORT_PRIVATE void getPropertyNames(JSGlobalObject*, PropertyNameArrayBuilder&, DontEnumPropertiesMode);

JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, JSGlobalObject*, PropertyNameArrayBuilder&, DontEnumPropertiesMode);

JS_EXPORT_PRIVATE static void NODELETE getOwnSpecialPropertyNames(JSObject*, JSGlobalObject*, PropertyNameArrayBuilder&, DontEnumPropertiesMode);

JS_EXPORT_PRIVATE void getOwnIndexedPropertyNames(JSGlobalObject*, PropertyNameArrayBuilder&, DontEnumPropertiesMode);

JS_EXPORT_PRIVATE void getOwnNonIndexPropertyNames(JSGlobalObject*, PropertyNameArrayBuilder&, DontEnumPropertiesMode);

void getNonReifiedStaticPropertyNames(VM&, PropertyNameArrayBuilder&, DontEnumPropertiesMode);

JS_EXPORT_PRIVATE uint32_t getEnumerableLength();

JS_EXPORT_PRIVATE JSValue toPrimitive(JSGlobalObject*, PreferredPrimitiveType = NoPreference) const;

JS_EXPORT_PRIVATE double toNumber(JSGlobalObject*) const;

JS_EXPORT_PRIVATE JSString* toString(JSGlobalObject*) const;

// This get function only looks at the property map.

JSValue getDirect(VM& vm, PropertyName propertyName) const

{

Structure* structure = this->structure();

PropertyOffset offset = structure->get(vm, propertyName);

checkOffset(offset, structure->inlineCapacity());

return offset != invalidOffset ? getDirect(offset) : JSValue();

}

JSValue getDirect(VM& vm, PropertyName propertyName, unsigned& attributes) const

{

Structure* structure = this->structure();

PropertyOffset offset = structure->get(vm, propertyName, attributes);

checkOffset(offset, structure->inlineCapacity());

return offset != invalidOffset ? getDirect(offset) : JSValue();

}

PropertyOffset getDirectOffset(VM& vm, PropertyName propertyName)

{

Structure* structure = this->structure();

PropertyOffset offset = structure->get(vm, propertyName);

checkOffset(offset, structure->inlineCapacity());

return offset;

}

PropertyOffset getDirectOffset(VM& vm, PropertyName propertyName, unsigned& attributes)

{

Structure* structure = this->structure();

PropertyOffset offset = structure->get(vm, propertyName, attributes);

checkOffset(offset, structure->inlineCapacity());

return offset;

}

bool hasInlineStorage() const { return structure()->hasInlineStorage(); }

ConstPropertyStorage inlineStorageUnsafe() const

{

return std::bit_cast<ConstPropertyStorage>(std::bit_cast<const char*>(this) + offsetOfInlineStorage());

}

PropertyStorage inlineStorageUnsafe()

{

return std::bit_cast<PropertyStorage>(std::bit_cast<char*>(this) + offsetOfInlineStorage());

}

ConstPropertyStorage inlineStorage() const

{

ASSERT(hasInlineStorage());

return inlineStorageUnsafe();

}

PropertyStorage inlineStorage()

{

ASSERT(hasInlineStorage());

return inlineStorageUnsafe();

}

const Butterfly* butterfly() const LIFETIME_BOUND

{

return const_cast<JSObject*>(this)->butterfly();

}

Butterfly* butterfly() LIFETIME_BOUND

{

// Access m_butterfly field of JSObjectWithButterfly regardless of whether this object is a derived class of JSObjectWithButterfly.

// This is safe as atom of GC heap allocation is 16 bytes, thus the butterfly field, offset from 8 byte, is always accessible.

// We intentionally load it regardless to make this function branchless. This is critical to keep this fast while we have butterfly-less objects.

auto* b = *std::bit_cast<Butterfly**>(std::bit_cast<char*>(this) + butterflyOffset());

if (type() == WebAssemblyGCObjectType) [[unlikely]]

b = nullptr;

return b;

}

ConstPropertyStorage outOfLineStorage() const { return butterfly()->propertyStorage(); }

PropertyStorage outOfLineStorage() { return butterfly()->propertyStorage(); }

ALWAYS_INLINE const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const

{

if (isInlineOffset(offset))

return &inlineStorage()[offsetInInlineStorage(offset)];

return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];

}

ALWAYS_INLINE WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset)

{

if (isInlineOffset(offset))

return &inlineStorage()[offsetInInlineStorage(offset)];

return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];

}

void transitionTo(VM&, Structure*);

bool hasCustomProperties() { return structure()->didTransition(); }

bool hasNonReifiedStaticProperties()

{

return TypeInfo::hasStaticPropertyTable(inlineTypeFlags()) && !structure()->staticPropertiesReified();

}

// putOwnDataProperty has 'put' like semantics, however this method:

// - assumes the object contains no own getter/setter properties.

// - provides no special handling for __proto__

// - does not walk the prototype chain (to check for accessors or non-writable properties).

// This is used by JSLexicalEnvironment.

bool putOwnDataProperty(VM&, PropertyName, JSValue, PutPropertySlot&);

bool putOwnDataPropertyMayBeIndex(JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

void putOwnDataPropertyBatching(VM&, UniquedStringImpl**, const EncodedJSValue*, unsigned size);

private:

void validatePutOwnDataProperty(VM&, PropertyName, JSValue);

public:

// Fast access to known property offsets.

ALWAYS_INLINE JSValue getDirect(PropertyOffset offset) const { return locationForOffset(offset)->get(); }

JSValue getDirect(Locker<JSCellLock>&, Concurrency, Structure* expectedStructure, PropertyOffset) const;

JSValue getDirectConcurrently(Locker<JSCellLock>&, Structure* expectedStructure, PropertyOffset) const;

void putDirectOffset(VM& vm, PropertyOffset offset, JSValue value) { locationForOffset(offset)->set(vm, this, value); }

void putDirectWithoutBarrier(PropertyOffset offset, JSValue value) { locationForOffset(offset)->setWithoutWriteBarrier(value); }

JS_EXPORT_PRIVATE bool putDirectNativeIntrinsicGetter(VM&, JSGlobalObject*, Identifier, NativeFunction, Intrinsic, unsigned attributes);

JS_EXPORT_PRIVATE void putDirectNativeIntrinsicGetterWithoutTransition(VM&, JSGlobalObject*, Identifier, NativeFunction, Intrinsic, unsigned attributes);

JS_EXPORT_PRIVATE bool putDirectNativeFunction(VM&, JSGlobalObject*, const PropertyName&, unsigned functionLength, NativeFunction, ImplementationVisibility, Intrinsic, unsigned attributes);

JS_EXPORT_PRIVATE bool putDirectNativeFunction(VM&, JSGlobalObject*, const PropertyName&, unsigned functionLength, NativeFunction, ImplementationVisibility, Intrinsic, const DOMJIT::Signature*, unsigned attributes);

JS_EXPORT_PRIVATE void putDirectNativeFunctionWithoutTransition(VM&, JSGlobalObject*, const PropertyName&, unsigned functionLength, NativeFunction, ImplementationVisibility, Intrinsic, unsigned attributes);

JS_EXPORT_PRIVATE JSFunction* putDirectBuiltinFunction(VM&, JSGlobalObject*, const PropertyName&, FunctionExecutable*, unsigned attributes);

JSFunction* putDirectBuiltinFunctionWithoutTransition(VM&, JSGlobalObject*, const PropertyName&, FunctionExecutable*, unsigned attributes);

JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, JSGlobalObject*, PropertyName, const PropertyDescriptor&, bool shouldThrow);

bool createDataProperty(JSGlobalObject*, PropertyName, JSValue, bool shouldThrow);

bool isEnvironment() const;

bool isGlobalObject() const;

bool isJSLexicalEnvironment() const;

bool isGlobalLexicalEnvironment() const;

bool isStrictEvalActivation() const;

bool isWithScope() const;

bool isErrorInstance() const;

JS_EXPORT_PRIVATE void seal(VM&);

JS_EXPORT_PRIVATE void freeze(VM&);

JS_EXPORT_PRIVATE static bool preventExtensions(JSObject*, JSGlobalObject*);

JS_EXPORT_PRIVATE static bool NODELETE isExtensible(JSObject*, JSGlobalObject*);

bool isSealed(VM& vm) { return structure()->isSealed(vm); }

bool isFrozen(VM& vm) { return structure()->isFrozen(vm); }

JS_EXPORT_PRIVATE bool NODELETE anyObjectInChainMayInterceptIndexedAccesses() const;

bool NODELETE needsSlowPutIndexing() const;

private:

TransitionKind NODELETE suggestedArrayStorageTransition() const;

public:

// You should only call isStructureExtensible() when:

// - Performing this check in a way that isn't described in the specification

// as calling the virtual [[IsExtensible]] trap.

// - When you're guaranteed that object->methodTable()->isExtensible isn't

// overridden.

ALWAYS_INLINE bool isStructureExtensible() { return structure()->isStructureExtensible(); }

// You should call this when performing [[IsExtensible]] trap in a place

// that is described in the specification. This performs the fully virtual

// [[IsExtensible]] trap.

bool isExtensible(JSGlobalObject*);

bool indexingShouldBeSparse()

{

return !isStructureExtensible()

|| structure()->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero();

}

bool staticPropertiesReified() { return structure()->staticPropertiesReified(); }

void reifyAllStaticProperties(JSGlobalObject*);

JS_EXPORT_PRIVATE Butterfly* allocateMoreOutOfLineStorage(VM&, size_t oldSize, size_t newSize);

// Call this when you do not need to change the structure.

inline void setButterfly(VM&, Butterfly*); // Defined in JSObjectInlines.h

// Call this if you do need to change the structure, or if you changed something about a structure

// in-place.

inline void nukeStructureAndSetButterfly(VM&, StructureID oldStructureID, Butterfly*); // Defined in JSObjectInlines.h

void setStructure(VM&, Structure*);

JS_EXPORT_PRIVATE void convertToDictionary(VM&);

JS_EXPORT_PRIVATE void convertToUncacheableDictionary(VM&);

void flattenDictionaryObject(VM& vm)

{

structure()->flattenDictionaryStructure(vm, this);

}

void shiftButterflyAfterFlattening(const GCSafeConcurrentJSLocker&, VM&, Structure* structure, size_t outOfLineCapacityAfter);

JSGlobalObject* realmMayBeNull() const

{

return structure()->realm();

}

JSGlobalObject* realm() const

{

SUPPRESS_FORWARD_DECL_ARG auto* result = realmMayBeNull();

RELEASE_ASSERT(result, "Do not call JSObject::realm() on objects with realmless structures (e.g., WebAssembly GC objects)");

ASSERT(!isGlobalObject() || ((JSObject*)result) == this);

return result;

}

void switchToSlowPutArrayStorage(VM&);

// The receiver is the prototype in this case. The following:

//

// asObject(foo->structure()->storedPrototype())->attemptToInterceptPutByIndexOnHoleForPrototype(...)

//

// is equivalent to:

//

// foo->attemptToInterceptPutByIndexOnHole(...);

bool attemptToInterceptPutByIndexOnHoleForPrototype(JSGlobalObject*, JSValue thisValue, unsigned propertyName, JSValue, bool shouldThrow, bool& putResult);

// Returns 0 if int32 storage cannot be created - either because

// indexing should be sparse, we're having a bad time, or because

// we already have a more general form of storage (double,

// contiguous, array storage).

ContiguousJSValues tryMakeWritableInt32(VM& vm)

{

if (hasInt32(indexingType()) && !isCopyOnWrite(indexingMode())) [[likely]]

return butterfly()->contiguousInt32();

return tryMakeWritableInt32Slow(vm);

}

// Returns 0 if double storage cannot be created - either because

// indexing should be sparse, we're having a bad time, or because

// we already have a more general form of storage (contiguous,

// or array storage).

ContiguousDoubles tryMakeWritableDouble(VM& vm)

{

if (hasDouble(indexingType()) && !isCopyOnWrite(indexingMode())) [[likely]]

return butterfly()->contiguousDouble();

return tryMakeWritableDoubleSlow(vm);

}

// Returns 0 if contiguous storage cannot be created - either because

// indexing should be sparse or because we're having a bad time.

ContiguousJSValues tryMakeWritableContiguous(VM& vm)

{

if (hasContiguous(indexingType()) && !isCopyOnWrite(indexingMode())) [[likely]]

return butterfly()->contiguous();

return tryMakeWritableContiguousSlow(vm);

}

// Ensure that the object is in a mode where it has array storage. Use

// this if you're about to perform actions that would have required the

// object to be converted to have array storage, if it didn't have it

// already.

ArrayStorage* ensureArrayStorage(VM& vm)

{

if (hasAnyArrayStorage(indexingType())) [[likely]]

return butterfly()->arrayStorage();

return ensureArrayStorageSlow(vm);

}

void ensureWritable(VM& vm)

{

if (isCopyOnWrite(indexingMode()))

convertFromCopyOnWrite(vm);

}

static constexpr size_t offsetOfInlineStorage();

static constexpr ptrdiff_t butterflyOffset()

{

return sizeof(JSObject);

}

void* butterflyAddress()

{

return std::bit_cast<char*>(this) + butterflyOffset();

}

JS_EXPORT_PRIVATE JSValue getMethod(JSGlobalObject*, CallData&, const Identifier&, const String& errorMessage);

bool canPerformFastPutInline(VM&, PropertyName);

bool canPerformFastPutInlineExcludingProto();

bool mayBePrototype() const;

void didBecomePrototype(VM&);

std::optional<Structure::PropertyHashEntry> findPropertyHashEntry(PropertyName) const;

DECLARE_EXPORT_INFO;

bool getOwnNonIndexPropertySlot(VM&, Structure*, PropertyName, PropertySlot&);

bool getNonIndexPropertySlot(JSGlobalObject*, PropertyName, PropertySlot&);

JS_EXPORT_PRIVATE NEVER_INLINE bool putInlineSlow(JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

JS_EXPORT_PRIVATE NEVER_INLINE bool putInlineFastReplacingStaticPropertyIfNeeded(JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

bool putInlineFast(JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);

protected:

#if ASSERT_ENABLED

void finishCreation(VM& vm)

{

Base::finishCreation(vm);

ASSERT(is<JSObject>(this));

ASSERT(structure()->hasPolyProto() || getPrototypeDirect().isNull() || Heap::heap(this) == Heap::heap(getPrototypeDirect()));

ASSERT(structure()->isObject());

ASSERT(classInfo());

}

#endif

inline static Structure* createStructure(VM&, JSGlobalObject*, JSValue);

// To instantiate objects you likely want JSFinalObject, below.

// To create derived types you likely want JSNonFinalObject, below.

JSObject(VM&, Structure*);

// Returns reference to butterfly field storage. Only valid for objects that have butterfly storage

// (JSObjectWithButterfly subclasses). Used by JSObject methods that manipulate butterfly storage.

ALWAYS_INLINE AuxiliaryBarrier<Butterfly*>& butterflyRef()

{

ASSERT(type() != WebAssemblyGCObjectType);

return *std::bit_cast<AuxiliaryBarrier<Butterfly*>*>(std::bit_cast<char*>(this) + butterflyOffset());

}

JSObject(CreatingWellDefinedBuiltinCellTag, StructureID structureID, int32_t blob)

: JSCell(CreatingWellDefinedBuiltinCell, structureID, blob)

{

}

// Call this if you know that the object is in a mode where it has array

// storage. This will assert otherwise.

ArrayStorage* arrayStorage()

{

ASSERT(hasAnyArrayStorage(indexingType()));

return butterfly()->arrayStorage();

}

// Call this if you want to predicate some actions on whether or not the

// object is in a mode where it has array storage.

ArrayStorage* arrayStorageOrNull()

{

switch (indexingType()) {

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

return butterfly()->arrayStorage();

default:

return nullptr;

}

}

size_t butterflyTotalSize();

size_t butterflyPreCapacity();

Butterfly* createInitialUndecided(VM&, unsigned length);

ContiguousJSValues createInitialInt32(VM&, unsigned length);

ContiguousDoubles createInitialDouble(VM&, unsigned length);

ContiguousJSValues createInitialContiguous(VM&, unsigned length);

void convertUndecidedForValue(VM&, JSValue);

void createInitialForValueAndSet(VM&, unsigned index, JSValue);

void convertInt32ForValue(VM&, JSValue);

void convertDoubleForValue(VM&, JSValue);

void convertFromCopyOnWrite(VM&);

static Butterfly* createArrayStorageButterfly(VM&, JSObject* intendedOwner, Structure*, unsigned length, unsigned vectorLength, Butterfly* oldButterfly = nullptr);