// Copyright 2014 the V8 project authors. All rights reserved.

// Use of this source code is governed by a BSD-style license that can be

// found in the LICENSE file.

#include "src/init/bootstrapper.h"

#include "include/v8-function.h"

#include "src/api/api-inl.h"

#include "src/api/api-natives.h"

#include "src/base/hashmap.h"

#include "src/base/ieee754.h"

#include "src/builtins/accessors.h"

#include "src/codegen/compiler.h"

#include "src/common/globals.h"

#include "src/debug/debug.h"

#include "src/execution/isolate-inl.h"

#include "src/execution/microtask-queue.h"

#include "src/execution/protectors.h"

#include "src/extensions/cputracemark-extension.h"

#include "src/extensions/externalize-string-extension.h"

#include "src/extensions/gc-extension.h"

#include "src/extensions/ignition-statistics-extension.h"

#include "src/extensions/statistics-extension.h"

#include "src/extensions/trigger-failure-extension.h"

#include "src/logging/runtime-call-stats-scope.h"

#include "src/objects/instance-type.h"

#include "src/objects/js-array.h"

#include "src/objects/js-function.h"

#include "src/objects/objects.h"

#include "src/sandbox/testing.h"

#ifdef ENABLE_VTUNE_TRACEMARK

#include "src/extensions/vtunedomain-support-extension.h"

#endif // ENABLE_VTUNE_TRACEMARK

#include "src/heap/heap-inl.h"

#include "src/logging/counters.h"

#include "src/logging/log.h"

#include "src/numbers/math-random.h"

#include "src/objects/api-callbacks.h"

#include "src/objects/arguments.h"

#include "src/objects/function-kind.h"

#include "src/objects/hash-table-inl.h"

#ifdef V8_INTL_SUPPORT

#include "src/objects/intl-objects.h"

#endif // V8_INTL_SUPPORT

#include "src/objects/js-array-buffer-inl.h"

#include "src/objects/js-array-inl.h"

#include "src/objects/js-atomics-synchronization.h"

#include "src/objects/js-disposable-stack.h"

#include "src/objects/js-iterator-helpers.h"

#ifdef V8_INTL_SUPPORT

#include "src/objects/js-break-iterator.h"

#include "src/objects/js-collator.h"

#include "src/objects/js-date-time-format.h"

#include "src/objects/js-display-names.h"

#include "src/objects/js-duration-format.h"

#include "src/objects/js-list-format.h"

#include "src/objects/js-locale.h"

#include "src/objects/js-number-format.h"

#include "src/objects/js-plural-rules.h"

#endif // V8_INTL_SUPPORT

#include "src/objects/js-regexp-string-iterator.h"

#include "src/objects/js-regexp.h"

#include "src/objects/js-shadow-realm.h"

#ifdef V8_INTL_SUPPORT

#include "src/objects/js-relative-time-format.h"

#include "src/objects/js-segment-iterator.h"

#include "src/objects/js-segmenter.h"

#include "src/objects/js-segments.h"

#endif // V8_INTL_SUPPORT

#include "src/codegen/script-details.h"

#include "src/objects/js-raw-json.h"

#include "src/objects/js-shared-array.h"

#include "src/objects/js-struct.h"

#include "src/objects/js-temporal-objects-inl.h"

#include "src/objects/js-weak-refs.h"

#include "src/objects/ordered-hash-table.h"

#include "src/objects/property-cell.h"

#include "src/objects/property-descriptor.h"

#include "src/objects/slots-inl.h"

#include "src/objects/swiss-name-dictionary-inl.h"

#include "src/objects/templates.h"

#include "src/snapshot/snapshot.h"

#include "src/zone/zone-hashmap.h"

#ifdef V8_FUZZILLI

#include "src/fuzzilli/fuzzilli.h"

#endif

#if V8_ENABLE_WEBASSEMBLY

#include "src/wasm/wasm-js.h"

#endif // V8_ENABLE_WEBASSEMBLY

namespace v8 {

namespace internal {

void SourceCodeCache::Initialize(Isolate* isolate, bool create_heap_objects) {

cache_ = create_heap_objects ? ReadOnlyRoots(isolate).empty_fixed_array()

: Tagged<FixedArray>();

}

void SourceCodeCache::Iterate(RootVisitor* v) {

v->VisitRootPointer(Root::kExtensions, nullptr, FullObjectSlot(&cache_));

}

bool SourceCodeCache::Lookup(Isolate* isolate, base::Vector<const char> name,

DirectHandle<SharedFunctionInfo>* handle) {

for (int i = 0; i < cache_->length(); i += 2) {

Tagged<SeqOneByteString> str = Cast<SeqOneByteString>(cache_->get(i));

if (str->IsOneByteEqualTo(name)) {

*handle =

direct_handle(Cast<SharedFunctionInfo>(cache_->get(i + 1)), isolate);

return true;

}

}

return false;

}

void SourceCodeCache::Add(Isolate* isolate, base::Vector<const char> name,

DirectHandle<SharedFunctionInfo> shared) {

Factory* factory = isolate->factory();

HandleScope scope(isolate);

int length = cache_->length();

DirectHandle<FixedArray> new_array =

factory->NewFixedArray(length + 2, AllocationType::kOld);

FixedArray::CopyElements(isolate, *new_array, 0, cache_, 0, cache_->length());

cache_ = *new_array;

DirectHandle<String> str =

factory

->NewStringFromOneByte(base::Vector<const uint8_t>::cast(name),

AllocationType::kOld)

.ToHandleChecked();

DCHECK(!str.is_null());

cache_->set(length, *str);

cache_->set(length + 1, *shared);

Cast<Script>(shared->script())->set_type(type_);

}

Bootstrapper::Bootstrapper(Isolate* isolate)

: isolate_(isolate),

nesting_(0),

extensions_cache_(Script::Type::kExtension) {}

void Bootstrapper::Initialize(bool create_heap_objects) {

extensions_cache_.Initialize(isolate_, create_heap_objects);

}

static const char* GCFunctionName() {

bool flag_given =

v8_flags.expose_gc_as != nullptr && strlen(v8_flags.expose_gc_as) != 0;

return flag_given ? v8_flags.expose_gc_as : "gc";

}

static bool isValidCpuTraceMarkFunctionName() {

return v8_flags.expose_cputracemark_as != nullptr &&

strlen(v8_flags.expose_cputracemark_as) != 0;

}

void Bootstrapper::InitializeOncePerProcess() {

v8::RegisterExtension(std::make_unique<GCExtension>(GCFunctionName()));

#ifdef V8_FUZZILLI

v8::RegisterExtension(std::make_unique<FuzzilliExtension>("fuzzilli"));

#endif

v8::RegisterExtension(std::make_unique<ExternalizeStringExtension>());

v8::RegisterExtension(std::make_unique<StatisticsExtension>());

v8::RegisterExtension(std::make_unique<TriggerFailureExtension>());

v8::RegisterExtension(std::make_unique<IgnitionStatisticsExtension>());

if (isValidCpuTraceMarkFunctionName()) {

v8::RegisterExtension(std::make_unique<CpuTraceMarkExtension>(

v8_flags.expose_cputracemark_as));

}

#ifdef ENABLE_VTUNE_TRACEMARK

v8::RegisterExtension(

std::make_unique<VTuneDomainSupportExtension>("vtunedomainmark"));

#endif // ENABLE_VTUNE_TRACEMARK

}

void Bootstrapper::TearDown() {

extensions_cache_.Initialize(isolate_, false); // Yes, symmetrical

}

class Genesis {

public:

Genesis(Isolate* isolate, MaybeDirectHandle<JSGlobalProxy> maybe_global_proxy,

v8::Local<v8::ObjectTemplate> global_proxy_template,

size_t context_snapshot_index,

DeserializeEmbedderFieldsCallback embedder_fields_deserializer,

v8::MicrotaskQueue* microtask_queue);

Genesis(Isolate* isolate, MaybeDirectHandle<JSGlobalProxy> maybe_global_proxy,

v8::Local<v8::ObjectTemplate> global_proxy_template);

~Genesis() = default;

Isolate* isolate() const { return isolate_; }

Factory* factory() const { return isolate_->factory(); }

Builtins* builtins() const { return isolate_->builtins(); }

Heap* heap() const { return isolate_->heap(); }

DirectHandle<NativeContext> result() { return result_; }

DirectHandle<JSGlobalProxy> global_proxy() { return global_proxy_; }

private:

DirectHandle<NativeContext> native_context() { return native_context_; }

// Creates some basic objects. Used for creating a context from scratch.

void CreateRoots();

// Creates the empty function. Used for creating a context from scratch.

DirectHandle<JSFunction> CreateEmptyFunction();

// Returns the %ThrowTypeError% intrinsic function.

// See ES#sec-%throwtypeerror% for details.

DirectHandle<JSFunction> GetThrowTypeErrorIntrinsic();

void CreateSloppyModeFunctionMaps(DirectHandle<JSFunction> empty);

void CreateStrictModeFunctionMaps(DirectHandle<JSFunction> empty);

void CreateObjectFunction(DirectHandle<JSFunction> empty);

void CreateIteratorMaps(DirectHandle<JSFunction> empty);

void CreateAsyncIteratorMaps(DirectHandle<JSFunction> empty);

void CreateAsyncFunctionMaps(DirectHandle<JSFunction> empty);

void CreateJSProxyMaps();

// Make the "arguments" and "caller" properties throw a TypeError on access.

void AddRestrictedFunctionProperties(DirectHandle<JSFunction> empty);

// Creates the global objects using the global proxy and the template passed

// in through the API. We call this regardless of whether we are building a

// context from scratch or using a deserialized one from the context snapshot

// but in the latter case we don't use the objects it produces directly, as

// we have to use the deserialized ones that are linked together with the

// rest of the context snapshot. At the end we link the global proxy and the

// context to each other.

DirectHandle<JSGlobalObject> CreateNewGlobals(

v8::Local<v8::ObjectTemplate> global_proxy_template,

DirectHandle<JSGlobalProxy> global_proxy);

// Similarly, we want to use the global that has been created by the templates

// passed through the API. The global from the snapshot is detached from the

// other objects in the snapshot.

void HookUpGlobalObject(DirectHandle<JSGlobalObject> global_object);

// Hooks the given global proxy into the context in the case we do not

// replace the global object from the deserialized native context.

void HookUpGlobalProxy(DirectHandle<JSGlobalProxy> global_proxy);

// The native context has a ScriptContextTable that store declarative bindings

// made in script scopes. Add a "this" binding to that table pointing to the

// global proxy.

void InstallGlobalThisBinding();

// New context initialization. Used for creating a context from scratch.

void InitializeGlobal(DirectHandle<JSGlobalObject> global_object,

DirectHandle<JSFunction> empty_function);

void InitializeExperimentalGlobal();

void InitializeIteratorFunctions();

void InitializeCallSiteBuiltins();

void InitializeConsole(DirectHandle<JSObject> extras_binding);

#define DECLARE_FEATURE_INITIALIZATION(id, descr) void InitializeGlobal_##id();

HARMONY_INPROGRESS(DECLARE_FEATURE_INITIALIZATION)

JAVASCRIPT_INPROGRESS_FEATURES(DECLARE_FEATURE_INITIALIZATION)

HARMONY_STAGED(DECLARE_FEATURE_INITIALIZATION)

JAVASCRIPT_STAGED_FEATURES(DECLARE_FEATURE_INITIALIZATION)

HARMONY_SHIPPING(DECLARE_FEATURE_INITIALIZATION)

JAVASCRIPT_SHIPPING_FEATURES(DECLARE_FEATURE_INITIALIZATION)

#undef DECLARE_FEATURE_INITIALIZATION

void InitializeGlobal_regexp_linear_flag();

void InitializeGlobal_sharedarraybuffer();

#if V8_ENABLE_WEBASSEMBLY

void InitializeWasmJSPI();

#endif

enum ArrayBufferKind { ARRAY_BUFFER, SHARED_ARRAY_BUFFER };

DirectHandle<JSFunction> CreateArrayBuffer(DirectHandle<String> name,

ArrayBufferKind array_buffer_kind);

bool InstallABunchOfRandomThings();

bool InstallExtrasBindings();

DirectHandle<JSFunction> InstallTypedArray(const char* name,

ElementsKind elements_kind,

InstanceType constructor_type,

int rab_gsab_initial_map_index);

void InitializeMapCaches();

enum ExtensionTraversalState { UNVISITED, VISITED, INSTALLED };

class ExtensionStates {

public:

ExtensionStates();

ExtensionStates(const ExtensionStates&) = delete;

ExtensionStates& operator=(const ExtensionStates&) = delete;

ExtensionTraversalState get_state(RegisteredExtension* extension);

void set_state(RegisteredExtension* extension,

ExtensionTraversalState state);

private:

base::HashMap map_;

};

// Used both for deserialized and from-scratch contexts to add the extensions

// provided.

static bool InstallExtensions(Isolate* isolate,

DirectHandle<Context> native_context,

v8::ExtensionConfiguration* extensions);

static bool InstallAutoExtensions(Isolate* isolate,

ExtensionStates* extension_states);

static bool InstallRequestedExtensions(Isolate* isolate,

v8::ExtensionConfiguration* extensions,

ExtensionStates* extension_states);

static bool InstallExtension(Isolate* isolate, const char* name,

ExtensionStates* extension_states);

static bool InstallExtension(Isolate* isolate,

v8::RegisteredExtension* current,

ExtensionStates* extension_states);

static bool InstallSpecialObjects(Isolate* isolate,

DirectHandle<NativeContext> native_context);

bool ConfigureApiObject(DirectHandle<JSObject> object,

DirectHandle<ObjectTemplateInfo> object_template);

bool ConfigureGlobalObject(

v8::Local<v8::ObjectTemplate> global_proxy_template);

// Migrates all properties from the 'from' object to the 'to'

// object and overrides the prototype in 'to' with the one from

// 'from'.

void TransferObject(DirectHandle<JSObject> from, DirectHandle<JSObject> to);

void TransferNamedProperties(DirectHandle<JSObject> from,

DirectHandle<JSObject> to);

void TransferIndexedProperties(DirectHandle<JSObject> from,

DirectHandle<JSObject> to);

DirectHandle<Map> CreateInitialMapForArraySubclass(int size,

int inobject_properties);

static bool CompileExtension(Isolate* isolate, v8::Extension* extension);

Isolate* isolate_;

DirectHandle<NativeContext> result_;

DirectHandle<NativeContext> native_context_;

DirectHandle<JSGlobalProxy> global_proxy_;

// %ThrowTypeError%. See ES#sec-%throwtypeerror% for details.

DirectHandle<JSFunction> restricted_properties_thrower_;

BootstrapperActive active_;

friend class Bootstrapper;

};

void Bootstrapper::Iterate(RootVisitor* v) {

extensions_cache_.Iterate(v);

v->Synchronize(VisitorSynchronization::kExtensions);

}

DirectHandle<NativeContext> Bootstrapper::CreateEnvironment(

MaybeDirectHandle<JSGlobalProxy> maybe_global_proxy,

v8::Local<v8::ObjectTemplate> global_proxy_template,

v8::ExtensionConfiguration* extensions, size_t context_snapshot_index,

DeserializeEmbedderFieldsCallback embedder_fields_deserializer,

v8::MicrotaskQueue* microtask_queue) {

HandleScope scope(isolate_);

DirectHandle<NativeContext> env;

{

Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template,

context_snapshot_index, embedder_fields_deserializer,

microtask_queue);

env = genesis.result();

if (env.is_null() || !InstallExtensions(env, extensions)) {

return {};

}

}

LogAllMaps();

isolate_->heap()->NotifyBootstrapComplete();

return scope.CloseAndEscape(env);

}

DirectHandle<JSGlobalProxy> Bootstrapper::NewRemoteContext(

MaybeDirectHandle<JSGlobalProxy> maybe_global_proxy,

v8::Local<v8::ObjectTemplate> global_proxy_template) {

HandleScope scope(isolate_);

DirectHandle<JSGlobalProxy> global_proxy;

{

Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template);

global_proxy = genesis.global_proxy();

if (global_proxy.is_null()) return {};

}

LogAllMaps();

return scope.CloseAndEscape(global_proxy);

}

void Bootstrapper::LogAllMaps() {

if (!v8_flags.log_maps || isolate_->initialized_from_snapshot()) return;

// Log all created Map objects that are on the heap. For snapshots the Map

// logging happens during deserialization in order to avoid printing Maps

// multiple times during partial deserialization.

LOG(isolate_, LogAllMaps());

}

namespace {

#ifdef DEBUG

bool IsFunctionMapOrSpecialBuiltin(DirectHandle<Map> map, Builtin builtin,

DirectHandle<Context> context) {

// During bootstrapping some of these maps could be not created yet.

return ((*map == context->GetNoCell(Context::STRICT_FUNCTION_MAP_INDEX)) ||

(*map == context->GetNoCell(

Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX)) ||

(*map ==

context->GetNoCell(

Context::STRICT_FUNCTION_WITH_READONLY_PROTOTYPE_MAP_INDEX)) ||

// Check if it's a creation of an empty or Proxy function during

// bootstrapping.

(builtin == Builtin::kEmptyFunction ||

builtin == Builtin::kProxyConstructor));

}

#endif // DEBUG

DirectHandle<SharedFunctionInfo> CreateSharedFunctionInfoForBuiltin(

Isolate* isolate, DirectHandle<String> name, Builtin builtin, int len,

AdaptArguments adapt) {

DirectHandle<SharedFunctionInfo> info =

isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin, len,

adapt);

info->set_language_mode(LanguageMode::kStrict);

#ifdef DEBUG

Tagged<Code> code = info->GetCode(isolate);

if (code->parameter_count() != kDontAdaptArgumentsSentinel) {

DCHECK_EQ(info->internal_formal_parameter_count_with_receiver(),

code->parameter_count());

}

#endif

return info;

}

V8_NOINLINE DirectHandle<JSFunction> CreateFunctionForBuiltin(

Isolate* isolate, DirectHandle<String> name, DirectHandle<Map> map,

Builtin builtin, int len, AdaptArguments adapt) {

DirectHandle<NativeContext> context(isolate->native_context());

DCHECK(IsFunctionMapOrSpecialBuiltin(map, builtin, context));

DirectHandle<SharedFunctionInfo> info =

CreateSharedFunctionInfoForBuiltin(isolate, name, builtin, len, adapt);

return Factory::JSFunctionBuilder{isolate, info, context}

.set_map(map)

.Build();

}

V8_NOINLINE DirectHandle<JSFunction> CreateFunctionForBuiltinWithPrototype(

Isolate* isolate, DirectHandle<String> name, Builtin builtin,

DirectHandle<UnionOf<JSPrototype, Hole>> prototype, InstanceType type,

int instance_size, int inobject_properties,

MutableMode prototype_mutability, int len, AdaptArguments adapt) {

Factory* factory = isolate->factory();

DirectHandle<NativeContext> context(isolate->native_context());

DirectHandle<Map> map =

prototype_mutability == MUTABLE

? isolate->strict_function_map()

: isolate->strict_function_with_readonly_prototype_map();

DCHECK(IsFunctionMapOrSpecialBuiltin(map, builtin, context));

DirectHandle<SharedFunctionInfo> info =

CreateSharedFunctionInfoForBuiltin(isolate, name, builtin, len, adapt);

info->set_expected_nof_properties(inobject_properties);

DirectHandle<JSFunction> result =

Factory::JSFunctionBuilder{isolate, info, context}.set_map(map).Build();

ElementsKind elements_kind;

switch (type) {

case JS_ARRAY_TYPE:

elements_kind = PACKED_SMI_ELEMENTS;

break;

case JS_ARGUMENTS_OBJECT_TYPE:

elements_kind = PACKED_ELEMENTS;

break;

default:

elements_kind = TERMINAL_FAST_ELEMENTS_KIND;

break;

}

DirectHandle<Map> initial_map = factory->NewContextfulMapForCurrentContext(

type, instance_size, elements_kind, inobject_properties);

initial_map->SetConstructor(*result);

if (type == JS_FUNCTION_TYPE) {

DCHECK_EQ(instance_size, JSFunction::kSizeWithPrototype);

// Since we are creating an initial map for JSFunction objects with

// prototype slot, set the respective bit.

initial_map->set_has_prototype_slot(true);

}

// TODO(littledan): Why do we have this is_generator test when

// NewFunctionPrototype already handles finding an appropriately

// shared prototype?

if (!IsResumableFunction(info->kind()) && IsTheHole(*prototype, isolate)) {

prototype = factory->NewFunctionPrototype(result);

}

JSFunction::SetInitialMap(isolate, result, initial_map,

Cast<JSPrototype>(prototype));

return result;

}

V8_NOINLINE Handle<JSFunction> CreateFunctionForBuiltinWithoutPrototype(

Isolate* isolate, DirectHandle<String> name, Builtin builtin, int len,

AdaptArguments adapt) {

DirectHandle<NativeContext> context(isolate->native_context());

DirectHandle<Map> map = isolate->strict_function_without_prototype_map();

DCHECK(IsFunctionMapOrSpecialBuiltin(map, builtin, context));

DirectHandle<SharedFunctionInfo> info =

CreateSharedFunctionInfoForBuiltin(isolate, name, builtin, len, adapt);

return Factory::JSFunctionBuilder{isolate, info, context}

.set_map(map)

.Build();

}

V8_NOINLINE DirectHandle<JSFunction> CreateFunction(

Isolate* isolate, DirectHandle<String> name, InstanceType type,

int instance_size, int inobject_properties,

DirectHandle<UnionOf<JSPrototype, Hole>> prototype, Builtin builtin,

int len, AdaptArguments adapt) {

DCHECK(Builtins::HasJSLinkage(builtin));

DirectHandle<JSFunction> result = CreateFunctionForBuiltinWithPrototype(

isolate, name, builtin, prototype, type, instance_size,

inobject_properties, IMMUTABLE, len, adapt);

// Make the JSFunction's prototype object fast.

JSObject::MakePrototypesFast(direct_handle(result->prototype(), isolate),

kStartAtReceiver, isolate);

// Make the resulting JSFunction object fast.

JSObject::MakePrototypesFast(result, kStartAtReceiver, isolate);

result->shared()->set_native(true);

return result;

}

V8_NOINLINE DirectHandle<JSFunction> CreateFunction(

Isolate* isolate, const char* name, InstanceType type, int instance_size,

int inobject_properties, DirectHandle<UnionOf<JSPrototype, Hole>> prototype,

Builtin builtin, int len, AdaptArguments adapt) {

return CreateFunction(

isolate, isolate->factory()->InternalizeUtf8String(name), type,

instance_size, inobject_properties, prototype, builtin, len, adapt);

}

V8_NOINLINE DirectHandle<JSFunction> InstallFunction(

Isolate* isolate, DirectHandle<JSObject> target, DirectHandle<String> name,

InstanceType type, int instance_size, int inobject_properties,

DirectHandle<UnionOf<JSPrototype, Hole>> prototype, Builtin call, int len,

AdaptArguments adapt) {

DCHECK(Builtins::HasJSLinkage(call));

DirectHandle<JSFunction> function =

CreateFunction(isolate, name, type, instance_size, inobject_properties,

prototype, call, len, adapt);

JSObject::AddProperty(isolate, target, name, function, DONT_ENUM);

return function;

}

V8_NOINLINE DirectHandle<JSFunction> InstallFunction(

Isolate* isolate, DirectHandle<JSObject> target, const char* name,

InstanceType type, int instance_size, int inobject_properties,

DirectHandle<UnionOf<JSPrototype, Hole>> prototype, Builtin call, int len,

AdaptArguments adapt) {

return InstallFunction(

isolate, target, isolate->factory()->InternalizeUtf8String(name), type,

instance_size, inobject_properties, prototype, call, len, adapt);

}

// This sets a constructor instance type on the constructor map which will be

// used in IsXxxConstructor() predicates. Having such predicates helps figuring

// out if a protector cell should be invalidated. If there are no protector

// cell checks required for constructor, this function must not be used.

// Note, this function doesn't create a copy of the constructor's map. So it's

// better to set constructor instance type after all the properties are added

// to the constructor and thus the map is already guaranteed to be unique.

V8_NOINLINE void SetConstructorInstanceType(

Isolate* isolate, DirectHandle<JSFunction> constructor,

InstanceType constructor_type) {

DCHECK(InstanceTypeChecker::IsJSFunction(constructor_type));

DCHECK_NE(constructor_type, JS_FUNCTION_TYPE);

Tagged<Map> map = constructor->map();

// Check we don't accidentally change one of the existing maps.

DCHECK_NE(map, *isolate->strict_function_map());

DCHECK_NE(map, *isolate->strict_function_with_readonly_prototype_map());

// Constructor function map is always a root map, and thus we don't have to

// deal with updating the whole transition tree.

DCHECK(IsUndefined(map->GetBackPointer(), isolate));

DCHECK_EQ(JS_FUNCTION_TYPE, map->instance_type());

map->set_instance_type(constructor_type);

}

V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,

DirectHandle<String> name,

Builtin call, int len,

AdaptArguments adapt) {

DCHECK(Builtins::HasJSLinkage(call));

name = String::Flatten(isolate, name, AllocationType::kOld);

Handle<JSFunction> fun =

CreateFunctionForBuiltinWithoutPrototype(isolate, name, call, len, adapt);

// Make the resulting JSFunction object fast.

JSObject::MakePrototypesFast(fun, kStartAtReceiver, isolate);

fun->shared()->set_native(true);

return fun;

}

V8_NOINLINE Handle<JSFunction> InstallFunctionWithBuiltinId(

Isolate* isolate, DirectHandle<JSObject> base, const char* name,

Builtin call, int len, AdaptArguments adapt) {

DirectHandle<String> internalized_name =

isolate->factory()->InternalizeUtf8String(name);

Handle<JSFunction> fun =

SimpleCreateFunction(isolate, internalized_name, call, len, adapt);

JSObject::AddProperty(isolate, base, internalized_name, fun, DONT_ENUM);

return fun;

}

V8_NOINLINE Handle<JSFunction> InstallFunctionAtSymbol(

Isolate* isolate, DirectHandle<JSObject> base, DirectHandle<Symbol> symbol,

const char* symbol_string, Builtin call, int len, AdaptArguments adapt,

PropertyAttributes attrs = DONT_ENUM) {

DirectHandle<String> internalized_symbol =

isolate->factory()->InternalizeUtf8String(symbol_string);

Handle<JSFunction> fun =

SimpleCreateFunction(isolate, internalized_symbol, call, len, adapt);

JSObject::AddProperty(isolate, base, symbol, fun, attrs);

return fun;

}

V8_NOINLINE DirectHandle<JSFunction> CreateSharedObjectConstructor(

Isolate* isolate, DirectHandle<String> name, DirectHandle<Map> instance_map,

Builtin builtin, int len, AdaptArguments adapt) {

Factory* factory = isolate->factory();

DirectHandle<SharedFunctionInfo> info =

factory->NewSharedFunctionInfoForBuiltin(name, builtin, len, adapt);

info->set_language_mode(LanguageMode::kStrict);

DirectHandle<JSFunction> constructor =

Factory::JSFunctionBuilder{isolate, info, isolate->native_context()}

.set_map(isolate->strict_function_with_readonly_prototype_map())

.Build();

constructor->set_prototype_or_initial_map(*instance_map, kReleaseStore);

JSObject::AddProperty(

isolate, constructor, factory->has_instance_symbol(),

direct_handle(

isolate->native_context()->shared_space_js_object_has_instance(),

isolate),

static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY));

return constructor;

}

V8_NOINLINE void SimpleInstallGetterSetter(Isolate* isolate,

DirectHandle<JSObject> base,

DirectHandle<Name> name,

Builtin call_getter,

Builtin call_setter) {

DirectHandle<String> getter_name =

Name::ToFunctionName(isolate, name, isolate->factory()->get_string())

.ToHandleChecked();

DirectHandle<JSFunction> getter =

SimpleCreateFunction(isolate, getter_name, call_getter, 0, kAdapt);

DirectHandle<String> setter_name =

Name::ToFunctionName(isolate, name, isolate->factory()->set_string())

.ToHandleChecked();

DirectHandle<JSFunction> setter =

SimpleCreateFunction(isolate, setter_name, call_setter, 1, kAdapt);

JSObject::DefineOwnAccessorIgnoreAttributes(base, name, getter, setter,

DONT_ENUM)

.Check();

}

void SimpleInstallGetterSetter(Isolate* isolate, DirectHandle<JSObject> base,

const char* name, Builtin call_getter,

Builtin call_setter) {

SimpleInstallGetterSetter(isolate, base,

isolate->factory()->InternalizeUtf8String(name),

call_getter, call_setter);

}

V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(

Isolate* isolate, DirectHandle<JSObject> base, DirectHandle<Name> name,

DirectHandle<Name> property_name, Builtin call, AdaptArguments adapt) {

DirectHandle<String> getter_name =

Name::ToFunctionName(isolate, name, isolate->factory()->get_string())

.ToHandleChecked();

Handle<JSFunction> getter =

SimpleCreateFunction(isolate, getter_name, call, 0, adapt);

DirectHandle<Object> setter = isolate->factory()->undefined_value();

JSObject::DefineOwnAccessorIgnoreAttributes(base, property_name, getter,

setter, DONT_ENUM)

.Check();

return getter;

}

V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Isolate* isolate,

DirectHandle<JSObject> base,

DirectHandle<Name> name,

Builtin call,

AdaptArguments adapt) {

return SimpleInstallGetter(isolate, base, name, name, call, adapt);

}

V8_NOINLINE void InstallConstant(Isolate* isolate,

DirectHandle<JSObject> holder,

const char* name, DirectHandle<Object> value) {

JSObject::AddProperty(

isolate, holder, isolate->factory()->InternalizeUtf8String(name), value,

static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));

}

V8_NOINLINE void InstallTrueValuedProperty(Isolate* isolate,

DirectHandle<JSObject> holder,

const char* name) {

JSObject::AddProperty(isolate, holder,

isolate->factory()->InternalizeUtf8String(name),

isolate->factory()->true_value(), NONE);

}

V8_NOINLINE void InstallSpeciesGetter(Isolate* isolate,

DirectHandle<JSFunction> constructor) {

Factory* factory = isolate->factory();

// TODO(adamk): We should be able to share a SharedFunctionInfo

// between all these JSFunctions.

SimpleInstallGetter(isolate, constructor, factory->symbol_species_string(),

factory->species_symbol(), Builtin::kReturnReceiver,

kAdapt);

}

V8_NOINLINE void InstallToStringTag(Isolate* isolate,

DirectHandle<JSObject> holder,

DirectHandle<String> value) {

JSObject::AddProperty(isolate, holder,

isolate->factory()->to_string_tag_symbol(), value,

static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));

}

void InstallToStringTag(Isolate* isolate, DirectHandle<JSObject> holder,

const char* value) {

InstallToStringTag(isolate, holder,

isolate->factory()->InternalizeUtf8String(value));

}

// Create a map for result objects returned from builtins in such a way that

// it's exactly the same map as the one produced by object literals. E.g.,

// iterator result objects have the same map as literals in the form `{value,

// done}`.

//

// This way we have better sharing of maps (i.e. less polymorphism) and also

// make it possible to hit the fast-paths in various builtins (i.e. promises and

// collections) with user defined iterators.

template <size_t N>

DirectHandle<Map> CreateLiteralObjectMapFromCache(

Isolate* isolate, const std::array<DirectHandle<Name>, N>& properties) {

Factory* factory = isolate->factory();

DirectHandle<NativeContext> native_context = isolate->native_context();

DirectHandle<Map> map = factory->ObjectLiteralMapFromCache(native_context, N);

for (DirectHandle<Name> name : properties) {

map = Map::CopyWithField(isolate, map, name, FieldType::Any(isolate), NONE,

PropertyConstness::kConst,

Representation::Tagged(), INSERT_TRANSITION)

.ToHandleChecked();

}

return map;

}

} // namespace

DirectHandle<JSFunction> Genesis::CreateEmptyFunction() {

// Allocate the function map first and then patch the prototype later.

DirectHandle<Map> empty_function_map =

factory()->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, {});

empty_function_map->set_is_prototype_map(true);

DCHECK(!empty_function_map->is_dictionary_map());

// Allocate the empty function as the prototype for function according to

// ES#sec-properties-of-the-function-prototype-object

DirectHandle<JSFunction> empty_function = CreateFunctionForBuiltin(

isolate(), factory()->empty_string(), empty_function_map,

Builtin::kEmptyFunction, 0, kDontAdapt);

empty_function_map->SetConstructor(*empty_function);

native_context()->set_empty_function(*empty_function);

// --- E m p t y ---

DirectHandle<String> source = factory()->InternalizeString("() {}");

DirectHandle<Script> script = factory()->NewScript(source);

script->set_type(Script::Type::kNative);

DirectHandle<WeakFixedArray> infos = factory()->NewWeakFixedArray(2);

script->set_infos(*infos);

ReadOnlyRoots roots{isolate()};

Tagged<SharedFunctionInfo> sfi = empty_function->shared();

sfi->set_raw_scope_info(roots.empty_function_scope_info());

sfi->SetScript(isolate(), roots, *script, 1);

sfi->UpdateFunctionMapIndex();

return empty_function;

}

void Genesis::CreateSloppyModeFunctionMaps(DirectHandle<JSFunction> empty) {

Factory* factory = isolate_->factory();

DirectHandle<Map> map;

//

// Allocate maps for sloppy functions without prototype.

//

map = factory->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);

native_context()->set_sloppy_function_without_prototype_map(*map);

//

// Allocate maps for sloppy functions with readonly prototype.

//

map =

factory->CreateSloppyFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);

native_context()->set_sloppy_function_with_readonly_prototype_map(*map);

//

// Allocate maps for sloppy functions with writable prototype.

//

map = factory->CreateSloppyFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,

empty);

native_context()->set_sloppy_function_map(*map);

map = factory->CreateSloppyFunctionMap(

FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);

native_context()->set_sloppy_function_with_name_map(*map);

}

DirectHandle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {

if (!restricted_properties_thrower_.is_null()) {

return restricted_properties_thrower_;

}

DirectHandle<String> name = factory()->empty_string();

DirectHandle<JSFunction> function = CreateFunctionForBuiltinWithoutPrototype(

isolate(), name, Builtin::kStrictPoisonPillThrower, 0, kAdapt);

// %ThrowTypeError% must have a name property with an empty string value. Per

// spec, ThrowTypeError's name is non-configurable, unlike ordinary functions'

// name property. To redefine it to be non-configurable, use

// SetOwnPropertyIgnoreAttributes.

JSObject::SetOwnPropertyIgnoreAttributes(

function, factory()->name_string(), factory()->empty_string(),

static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))

.Assert();

// length needs to be non configurable.

DirectHandle<Object> value(Smi::FromInt(function->length()), isolate());

JSObject::SetOwnPropertyIgnoreAttributes(

function, factory()->length_string(), value,

static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))

.Assert();

if (JSObject::PreventExtensions(isolate_, function, kThrowOnError)

.IsNothing()) {

DCHECK(false);

}

JSObject::MigrateSlowToFast(function, 0, "Bootstrapping");

restricted_properties_thrower_ = function;

return function;

}

void Genesis::CreateStrictModeFunctionMaps(DirectHandle<JSFunction> empty) {

Factory* factory = isolate_->factory();

DirectHandle<Map> map;

//

// Allocate maps for strict functions without prototype.

//

map = factory->CreateStrictFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);

native_context()->set_strict_function_without_prototype_map(*map);

map = factory->CreateStrictFunctionMap(METHOD_WITH_NAME, empty);

native_context()->set_method_with_name_map(*map);

//

// Allocate maps for strict functions with writable prototype.

//

map = factory->CreateStrictFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,

empty);

native_context()->set_strict_function_map(*map);

map = factory->CreateStrictFunctionMap(

FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);

native_context()->set_strict_function_with_name_map(*map);

//

// Allocate maps for strict functions with readonly prototype.

//

map =

factory->CreateStrictFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);

native_context()->set_strict_function_with_readonly_prototype_map(*map);

//

// Allocate map for class functions.

//

map = factory->CreateClassFunctionMap(empty);

native_context()->set_class_function_map(*map);

// Now that the strict mode function map is available, set up the

// restricted "arguments" and "caller" getters.

AddRestrictedFunctionProperties(empty);

}

void Genesis::CreateObjectFunction(DirectHandle<JSFunction> empty_function) {

Factory* factory = isolate_->factory();

// --- O b j e c t ---

int inobject_properties = JSObject::kInitialGlobalObjectUnusedPropertiesCount;

int instance_size = JSObject::kHeaderSize + kTaggedSize * inobject_properties;

DirectHandle<JSFunction> object_fun =

CreateFunction(isolate_, factory->Object_string(), JS_OBJECT_TYPE,

instance_size, inobject_properties, factory->null_value(),

Builtin::kObjectConstructor, 1, kDontAdapt);

native_context()->set_object_function(*object_fun);

{

// Finish setting up Object function's initial map.

Tagged<Map> initial_map = object_fun->initial_map();

initial_map->set_elements_kind(HOLEY_ELEMENTS);

}

// Allocate a new prototype for the object function.

DirectHandle<JSObject> object_function_prototype =

factory->NewFunctionPrototype(object_fun);

{

DirectHandle<Map> map = Map::Copy(

isolate(), direct_handle(object_function_prototype->map(), isolate()),

"EmptyObjectPrototype");

map->set_is_prototype_map(true);

// Ban re-setting Object.prototype.__proto__ to prevent Proxy security bug

map->set_is_immutable_proto(true);

object_function_prototype->set_map(isolate(), *map);

}

// Complete setting up empty function.

{

DirectHandle<Map> empty_function_map(empty_function->map(), isolate_);

Map::SetPrototype(isolate(), empty_function_map, object_function_prototype);

}

native_context()->set_initial_object_prototype(*object_function_prototype);

JSFunction::SetPrototype(isolate_, object_fun, object_function_prototype);

object_function_prototype->map()->set_instance_type(JS_OBJECT_PROTOTYPE_TYPE);

{

// Set up slow map for Object.create(null) instances without in-object

// properties.

DirectHandle<Map> map(object_fun->initial_map(), isolate_);

map = Map::CopyInitialMapNormalized(isolate(), map);

Map::SetPrototype(isolate(), map, factory->null_value());

native_context()->set_slow_object_with_null_prototype_map(*map);

// Set up slow map for literals with too many properties.

map = Map::Copy(isolate(), map, "slow_object_with_object_prototype_map");

Map::SetPrototype(isolate(), map, object_function_prototype);

native_context()->set_slow_object_with_object_prototype_map(*map);

}

}

namespace {

DirectHandle<Map> CreateNonConstructorMap(Isolate* isolate,

DirectHandle<Map> source_map,

DirectHandle<JSObject> prototype,

const char* reason) {

DirectHandle<Map> map = Map::Copy(isolate, source_map, reason);

// Ensure the resulting map has prototype slot (it is necessary for storing

// initial map even when the prototype property is not required).

if (!map->has_prototype_slot()) {

// Re-set the unused property fields after changing the instance size.

int unused_property_fields = map->UnusedPropertyFields();

map->set_instance_size(map->instance_size() + kTaggedSize);

// The prototype slot shifts the in-object properties area by one slot.

map->SetInObjectPropertiesStartInWords(

map->GetInObjectPropertiesStartInWords() + 1);

map->set_has_prototype_slot(true);

map->SetInObjectUnusedPropertyFields(unused_property_fields);

}

map->set_is_constructor(false);

Map::SetPrototype(isolate, map, prototype);

return map;

}

} // namespace

Handle<JSFunction> SimpleInstallFunction(Isolate* isolate,

DirectHandle<JSObject> base,

const char* name, Builtin call,

int len, AdaptArguments adapt,

PropertyAttributes attrs) {

// Although function name does not have to be internalized the property name

// will be internalized during property addition anyway, so do it here now.

DirectHandle<String> internalized_name =

isolate->factory()->InternalizeUtf8String(name);

Handle<JSFunction> fun =

SimpleCreateFunction(isolate, internalized_name, call, len, adapt);