Teach Call ICs how to call Wasm
[WebKit-https.git] / Source / JavaScriptCore / runtime / VM.cpp
1 /*
2  * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer. 
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution. 
13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission. 
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28
29 #include "config.h"
30 #include "VM.h"
31
32 #include "ArgList.h"
33 #include "ArrayBufferNeuteringWatchpointSet.h"
34 #include "BuiltinExecutables.h"
35 #include "BytecodeIntrinsicRegistry.h"
36 #include "CodeBlock.h"
37 #include "CodeCache.h"
38 #include "CommonIdentifiers.h"
39 #include "CommonSlowPaths.h"
40 #include "CustomGetterSetter.h"
41 #include "DFGWorklist.h"
42 #include "DirectEvalExecutable.h"
43 #include "Disassembler.h"
44 #include "Error.h"
45 #include "ErrorConstructor.h"
46 #include "ErrorInstance.h"
47 #include "EvalCodeBlock.h"
48 #include "Exception.h"
49 #include "ExecutableToCodeBlockEdge.h"
50 #include "FTLThunks.h"
51 #include "FastMallocAlignedMemoryAllocator.h"
52 #include "FunctionCodeBlock.h"
53 #include "FunctionConstructor.h"
54 #include "FunctionExecutable.h"
55 #include "GCActivityCallback.h"
56 #include "GetterSetter.h"
57 #include "GigacageAlignedMemoryAllocator.h"
58 #include "HasOwnPropertyCache.h"
59 #include "Heap.h"
60 #include "HeapIterationScope.h"
61 #include "HeapProfiler.h"
62 #include "HostCallReturnValue.h"
63 #include "Identifier.h"
64 #include "IncrementalSweeper.h"
65 #include "IndirectEvalExecutable.h"
66 #include "InferredValue.h"
67 #include "Interpreter.h"
68 #include "IntlCollatorConstructor.h"
69 #include "IntlDateTimeFormatConstructor.h"
70 #include "IntlNumberFormatConstructor.h"
71 #include "IntlPluralRulesConstructor.h"
72 #include "JITCode.h"
73 #include "JITWorklist.h"
74 #include "JSAPIValueWrapper.h"
75 #include "JSArray.h"
76 #include "JSArrayBufferConstructor.h"
77 #include "JSAsyncFunction.h"
78 #include "JSBigInt.h"
79 #include "JSBoundFunction.h"
80 #include "JSCInlines.h"
81 #include "JSCallbackFunction.h"
82 #include "JSCustomGetterSetterFunction.h"
83 #include "JSDestructibleObjectHeapCellType.h"
84 #include "JSFixedArray.h"
85 #include "JSFunction.h"
86 #include "JSGlobalObjectFunctions.h"
87 #include "JSImmutableButterfly.h"
88 #include "JSInternalPromiseDeferred.h"
89 #include "JSLock.h"
90 #include "JSMap.h"
91 #include "JSMapIterator.h"
92 #include "JSPromiseDeferred.h"
93 #include "JSPropertyNameEnumerator.h"
94 #include "JSScriptFetchParameters.h"
95 #include "JSScriptFetcher.h"
96 #include "JSSet.h"
97 #include "JSSetIterator.h"
98 #include "JSSourceCode.h"
99 #include "JSStringHeapCellType.h"
100 #include "JSTemplateObjectDescriptor.h"
101 #include "JSWeakMap.h"
102 #include "JSWeakSet.h"
103 #include "JSWebAssembly.h"
104 #include "JSWebAssemblyCodeBlock.h"
105 #include "JSWebAssemblyCodeBlockHeapCellType.h"
106 #include "JSWithScope.h"
107 #include "LLIntData.h"
108 #include "Lexer.h"
109 #include "Lookup.h"
110 #include "MinimumReservedZoneSize.h"
111 #include "ModuleProgramCodeBlock.h"
112 #include "ModuleProgramExecutable.h"
113 #include "NativeErrorConstructor.h"
114 #include "NativeExecutable.h"
115 #include "NativeStdFunctionCell.h"
116 #include "Nodes.h"
117 #include "ObjCCallbackFunction.h"
118 #include "Parser.h"
119 #include "ProfilerDatabase.h"
120 #include "ProgramCodeBlock.h"
121 #include "ProgramExecutable.h"
122 #include "PromiseDeferredTimer.h"
123 #include "PropertyMapHashTable.h"
124 #include "ProxyRevoke.h"
125 #include "RandomizingFuzzerAgent.h"
126 #include "RegExpCache.h"
127 #include "RegExpObject.h"
128 #include "RegisterAtOffsetList.h"
129 #include "RuntimeType.h"
130 #include "SamplingProfiler.h"
131 #include "ShadowChicken.h"
132 #include "SimpleTypedArrayController.h"
133 #include "SourceProviderCache.h"
134 #include "StackVisitor.h"
135 #include "StrictEvalActivation.h"
136 #include "StrongInlines.h"
137 #include "StructureInlines.h"
138 #include "TestRunnerUtils.h"
139 #include "ThunkGenerators.h"
140 #include "TypeProfiler.h"
141 #include "TypeProfilerLog.h"
142 #include "UnlinkedCodeBlock.h"
143 #include "VMEntryScope.h"
144 #include "VMInlines.h"
145 #include "VMInspector.h"
146 #include "VariableEnvironment.h"
147 #include "WasmWorklist.h"
148 #include "Watchdog.h"
149 #include "WeakGCMapInlines.h"
150 #include "WebAssemblyFunction.h"
151 #include "WebAssemblyFunctionHeapCellType.h"
152 #include "WebAssemblyWrapperFunction.h"
153 #include <wtf/ProcessID.h>
154 #include <wtf/ReadWriteLock.h>
155 #include <wtf/SimpleStats.h>
156 #include <wtf/StringPrintStream.h>
157 #include <wtf/Threading.h>
158 #include <wtf/text/AtomicStringTable.h>
159 #include <wtf/text/SymbolRegistry.h>
160
161 #if ENABLE(C_LOOP)
162 #include "CLoopStack.h"
163 #include "CLoopStackInlines.h"
164 #endif
165
166 #if ENABLE(DFG_JIT)
167 #include "ConservativeRoots.h"
168 #endif
169
170 #if ENABLE(REGEXP_TRACING)
171 #include "RegExp.h"
172 #endif
173
174 namespace JSC {
175
176 #if ENABLE(JIT)
177 #if !ASSERT_DISABLED
178 bool VM::s_canUseJITIsSet = false;
179 #endif
180 bool VM::s_canUseJIT = false;
181 #endif
182
183 Atomic<unsigned> VM::s_numberOfIDs;
184
185 // Note: Platform.h will enforce that ENABLE(ASSEMBLER) is true if either
186 // ENABLE(JIT) or ENABLE(YARR_JIT) or both are enabled. The code below
187 // just checks for ENABLE(JIT) or ENABLE(YARR_JIT) with this premise in mind.
188
189 #if ENABLE(ASSEMBLER)
190 static bool enableAssembler()
191 {
192     if (!Options::useJIT() && !Options::useRegExpJIT())
193         return false;
194
195     char* canUseJITString = getenv("JavaScriptCoreUseJIT");
196     if (canUseJITString && !atoi(canUseJITString))
197         return false;
198
199     ExecutableAllocator::initializeUnderlyingAllocator();
200     if (!ExecutableAllocator::singleton().isValid()) {
201         if (Options::crashIfCantAllocateJITMemory())
202             CRASH();
203         return false;
204     }
205
206     return true;
207 }
208 #endif // ENABLE(!ASSEMBLER)
209
210 bool VM::canUseAssembler()
211 {
212 #if ENABLE(ASSEMBLER)
213     static std::once_flag onceKey;
214     static bool enabled = false;
215     std::call_once(onceKey, [] {
216         enabled = enableAssembler();
217     });
218     return enabled;
219 #else
220     return false; // interpreter only
221 #endif
222 }
223
224 void VM::computeCanUseJIT()
225 {
226 #if ENABLE(JIT)
227 #if !ASSERT_DISABLED
228     RELEASE_ASSERT(!s_canUseJITIsSet);
229     s_canUseJITIsSet = true;
230 #endif
231     s_canUseJIT = VM::canUseAssembler() && Options::useJIT();
232 #endif
233 }
234
235 bool VM::canUseRegExpJIT()
236 {
237 #if ENABLE(YARR_JIT)
238     static std::once_flag onceKey;
239     static bool enabled = false;
240     std::call_once(onceKey, [] {
241         enabled = VM::canUseAssembler() && Options::useRegExpJIT();
242     });
243     return enabled;
244 #else
245     return false; // interpreter only
246 #endif
247 }
248
249 bool VM::isInMiniMode()
250 {
251     return !canUseJIT() || Options::forceMiniVMMode();
252 }
253
254 inline unsigned VM::nextID()
255 {
256     for (;;) {
257         unsigned currentNumberOfIDs = s_numberOfIDs.load();
258         unsigned newID = currentNumberOfIDs + 1;
259         if (s_numberOfIDs.compareExchangeWeak(currentNumberOfIDs, newID))
260             return newID;
261     }
262 }
263
264 static bool vmCreationShouldCrash = false;
265
266 VM::VM(VMType vmType, HeapType heapType)
267     : m_id(nextID())
268     , m_apiLock(adoptRef(new JSLock(this)))
269 #if USE(CF)
270     , m_runLoop(CFRunLoopGetCurrent())
271 #endif // USE(CF)
272     , heap(this, heapType)
273     , fastMallocAllocator(std::make_unique<FastMallocAlignedMemoryAllocator>())
274     , primitiveGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::Primitive))
275     , jsValueGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::JSValue))
276     , auxiliaryHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::Auxiliary)))
277     , immutableButterflyHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCellWithInteriorPointers)))
278     , cellHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
279     , destructibleCellHeapCellType(std::make_unique<HeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)))
280     , stringHeapCellType(std::make_unique<JSStringHeapCellType>())
281     , destructibleObjectHeapCellType(std::make_unique<JSDestructibleObjectHeapCellType>())
282 #if ENABLE(WEBASSEMBLY)
283     , webAssemblyCodeBlockHeapCellType(std::make_unique<JSWebAssemblyCodeBlockHeapCellType>())
284     , webAssemblyFunctionHeapCellType(std::make_unique<WebAssemblyFunctionHeapCellType>())
285 #endif
286     , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get())
287     , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get())
288     , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get())
289     , cellSpace("JSCell", heap, cellHeapCellType.get(), fastMallocAllocator.get())
290     , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellHeapCellType.get(), jsValueGigacageAllocator.get())
291     , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get())
292     , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get())
293     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
294     , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
295     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge)
296     , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction)
297     , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
298     , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable)
299     , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable)
300     , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData)
301     , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure)
302     , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
303     , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
304     , codeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), CodeBlock)
305     , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
306     , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable)
307     , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable)
308     , vmType(vmType)
309     , clientData(0)
310     , topEntryFrame(nullptr)
311     , topCallFrame(CallFrame::noCaller())
312     , promiseDeferredTimer(std::make_unique<PromiseDeferredTimer>(*this))
313     , m_atomicStringTable(vmType == Default ? Thread::current().atomicStringTable() : new AtomicStringTable)
314     , propertyNames(nullptr)
315     , emptyList(new ArgList)
316     , machineCodeBytesPerBytecodeWordForBaselineJIT(std::make_unique<SimpleStats>())
317     , customGetterSetterFunctionMap(*this)
318     , stringCache(*this)
319     , symbolImplToSymbolMap(*this)
320     , structureCache(*this)
321     , interpreter(0)
322     , entryScope(0)
323     , m_regExpCache(new RegExpCache(this))
324     , m_compactVariableMap(adoptRef(*(new CompactVariableMap)))
325 #if ENABLE(REGEXP_TRACING)
326     , m_rtTraceList(new RTTraceList())
327 #endif
328 #if ENABLE(GC_VALIDATION)
329     , m_initializingObjectClass(0)
330 #endif
331     , m_stackPointerAtVMEntry(0)
332     , m_codeCache(std::make_unique<CodeCache>())
333     , m_builtinExecutables(std::make_unique<BuiltinExecutables>(*this))
334     , m_typeProfilerEnabledCount(0)
335     , m_primitiveGigacageEnabled(IsWatched)
336     , m_controlFlowProfilerEnabledCount(0)
337 {
338     if (UNLIKELY(vmCreationShouldCrash))
339         CRASH_WITH_INFO(0x4242424220202020, 0xbadbeef0badbeef, 0x1234123412341234, 0x1337133713371337);
340
341     interpreter = new Interpreter(*this);
342     StackBounds stack = Thread::current().stack();
343     updateSoftReservedZoneSize(Options::softReservedZoneSize());
344     setLastStackTop(stack.origin());
345
346     JSRunLoopTimer::Manager::shared().registerVM(*this);
347
348     // Need to be careful to keep everything consistent here
349     JSLockHolder lock(this);
350     AtomicStringTable* existingEntryAtomicStringTable = Thread::current().setCurrentAtomicStringTable(m_atomicStringTable);
351     structureStructure.set(*this, Structure::createStructure(*this));
352     structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
353     stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
354
355     smallStrings.initializeCommonStrings(*this);
356
357     propertyNames = new CommonIdentifiers(this);
358     terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
359     propertyNameEnumeratorStructure.set(*this, JSPropertyNameEnumerator::createStructure(*this, 0, jsNull()));
360     customGetterSetterStructure.set(*this, CustomGetterSetter::createStructure(*this, 0, jsNull()));
361     domAttributeGetterSetterStructure.set(*this, DOMAttributeGetterSetter::createStructure(*this, 0, jsNull()));
362     scopedArgumentsTableStructure.set(*this, ScopedArgumentsTable::createStructure(*this, 0, jsNull()));
363     apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, 0, jsNull()));
364     nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, 0, jsNull()));
365     evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, 0, jsNull()));
366     programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, 0, jsNull()));
367     functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, 0, jsNull()));
368 #if ENABLE(WEBASSEMBLY)
369     webAssemblyCodeBlockStructure.set(*this, JSWebAssemblyCodeBlock::createStructure(*this, 0, jsNull()));
370 #endif
371     moduleProgramExecutableStructure.set(*this, ModuleProgramExecutable::createStructure(*this, 0, jsNull()));
372     regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
373     symbolStructure.set(*this, Symbol::createStructure(*this, 0, jsNull()));
374     symbolTableStructure.set(*this, SymbolTable::createStructure(*this, 0, jsNull()));
375     fixedArrayStructure.set(*this, JSFixedArray::createStructure(*this, 0, jsNull()));
376
377     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithInt32) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithInt32));
378     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithDouble) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithDouble));
379     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithContiguous) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithContiguous));
380
381     sourceCodeStructure.set(*this, JSSourceCode::createStructure(*this, 0, jsNull()));
382     scriptFetcherStructure.set(*this, JSScriptFetcher::createStructure(*this, 0, jsNull()));
383     scriptFetchParametersStructure.set(*this, JSScriptFetchParameters::createStructure(*this, 0, jsNull()));
384     structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
385     sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
386     templateObjectDescriptorStructure.set(*this, JSTemplateObjectDescriptor::createStructure(*this, 0, jsNull()));
387     arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpointSet::createStructure(*this));
388     unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
389     unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
390     unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
391     unlinkedFunctionCodeBlockStructure.set(*this, UnlinkedFunctionCodeBlock::createStructure(*this, 0, jsNull()));
392     unlinkedModuleProgramCodeBlockStructure.set(*this, UnlinkedModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
393     propertyTableStructure.set(*this, PropertyTable::createStructure(*this, 0, jsNull()));
394     if (VM::canUseJIT())
395         inferredValueStructure.set(*this, InferredValue::createStructure(*this, 0, jsNull()));
396     functionRareDataStructure.set(*this, FunctionRareData::createStructure(*this, 0, jsNull()));
397     exceptionStructure.set(*this, Exception::createStructure(*this, 0, jsNull()));
398     promiseDeferredStructure.set(*this, JSPromiseDeferred::createStructure(*this, 0, jsNull()));
399     internalPromiseDeferredStructure.set(*this, JSInternalPromiseDeferred::createStructure(*this, 0, jsNull()));
400     nativeStdFunctionCellStructure.set(*this, NativeStdFunctionCell::createStructure(*this, 0, jsNull()));
401     programCodeBlockStructure.set(*this, ProgramCodeBlock::createStructure(*this, 0, jsNull()));
402     moduleProgramCodeBlockStructure.set(*this, ModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
403     evalCodeBlockStructure.set(*this, EvalCodeBlock::createStructure(*this, 0, jsNull()));
404     functionCodeBlockStructure.set(*this, FunctionCodeBlock::createStructure(*this, 0, jsNull()));
405     hashMapBucketSetStructure.set(*this, HashMapBucket<HashMapBucketDataKey>::createStructure(*this, 0, jsNull()));
406     hashMapBucketMapStructure.set(*this, HashMapBucket<HashMapBucketDataKeyValue>::createStructure(*this, 0, jsNull()));
407     bigIntStructure.set(*this, JSBigInt::createStructure(*this, 0, jsNull()));
408     executableToCodeBlockEdgeStructure.set(*this, ExecutableToCodeBlockEdge::createStructure(*this, nullptr, jsNull()));
409
410     // Eagerly initialize constant cells since the concurrent compiler can access them.
411     if (canUseJIT()) {
412         sentinelMapBucket();
413         sentinelSetBucket();
414     }
415
416     Thread::current().setCurrentAtomicStringTable(existingEntryAtomicStringTable);
417     
418 #if !ENABLE(C_LOOP)
419     initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
420 #endif
421     
422     Gigacage::addPrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
423
424     heap.notifyIsSafeToCollect();
425     
426     LLInt::Data::performAssertions(*this);
427     
428     if (UNLIKELY(Options::useProfiler())) {
429         m_perBytecodeProfiler = std::make_unique<Profiler::Database>(*this);
430
431         StringPrintStream pathOut;
432         const char* profilerPath = getenv("JSC_PROFILER_PATH");
433         if (profilerPath)
434             pathOut.print(profilerPath, "/");
435         pathOut.print("JSCProfile-", getCurrentProcessID(), "-", m_perBytecodeProfiler->databaseID(), ".json");
436         m_perBytecodeProfiler->registerToSaveAtExit(pathOut.toCString().data());
437     }
438
439     callFrameForCatch = nullptr;
440
441     // Initialize this last, as a free way of asserting that VM initialization itself
442     // won't use this.
443     m_typedArrayController = adoptRef(new SimpleTypedArrayController());
444
445     m_bytecodeIntrinsicRegistry = std::make_unique<BytecodeIntrinsicRegistry>(*this);
446
447     if (Options::useTypeProfiler())
448         enableTypeProfiler();
449     if (Options::useControlFlowProfiler())
450         enableControlFlowProfiler();
451 #if ENABLE(SAMPLING_PROFILER)
452     if (Options::useSamplingProfiler()) {
453         setShouldBuildPCToCodeOriginMapping();
454         Ref<Stopwatch> stopwatch = Stopwatch::create();
455         stopwatch->start();
456         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
457         if (Options::samplingProfilerPath())
458             m_samplingProfiler->registerForReportAtExit();
459         m_samplingProfiler->start();
460     }
461 #endif // ENABLE(SAMPLING_PROFILER)
462     if (Options::useRandomizingFuzzerAgent())
463         setFuzzerAgent(std::make_unique<RandomizingFuzzerAgent>(*this));
464
465     if (Options::alwaysGeneratePCToCodeOriginMap())
466         setShouldBuildPCToCodeOriginMapping();
467
468     if (Options::watchdog()) {
469         Watchdog& watchdog = ensureWatchdog();
470         watchdog.setTimeLimit(Seconds::fromMilliseconds(Options::watchdog()));
471     }
472
473 #if ENABLE(JIT)
474     // Make sure that any stubs that the JIT is going to use are initialized in non-compilation threads.
475     if (canUseJIT()) {
476         jitStubs = std::make_unique<JITThunks>();
477 #if ENABLE(FTL_JIT)
478         ftlThunks = std::make_unique<FTL::Thunks>();
479 #endif // ENABLE(FTL_JIT)
480         getCTIInternalFunctionTrampolineFor(CodeForCall);
481         getCTIInternalFunctionTrampolineFor(CodeForConstruct);
482     }
483 #endif
484
485     if (Options::forceDebuggerBytecodeGeneration() || Options::alwaysUseShadowChicken())
486         ensureShadowChicken();
487
488     VMInspector::instance().add(this);
489 }
490
491 static ReadWriteLock s_destructionLock;
492
493 void waitForVMDestruction()
494 {
495     auto locker = holdLock(s_destructionLock.write());
496 }
497
498 VM::~VM()
499 {
500     auto destructionLocker = holdLock(s_destructionLock.read());
501     
502     Gigacage::removePrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
503     promiseDeferredTimer->stopRunningTasks();
504 #if ENABLE(WEBASSEMBLY)
505     if (Wasm::Worklist* worklist = Wasm::existingWorklistOrNull())
506         worklist->stopAllPlansForContext(wasmContext);
507 #endif
508     if (UNLIKELY(m_watchdog))
509         m_watchdog->willDestroyVM(this);
510     m_traps.willDestroyVM();
511     VMInspector::instance().remove(this);
512
513     // Never GC, ever again.
514     heap.incrementDeferralDepth();
515
516 #if ENABLE(SAMPLING_PROFILER)
517     if (m_samplingProfiler) {
518         m_samplingProfiler->reportDataToOptionFile();
519         m_samplingProfiler->shutdown();
520     }
521 #endif // ENABLE(SAMPLING_PROFILER)
522     
523 #if ENABLE(JIT)
524     if (JITWorklist* worklist = JITWorklist::existingGlobalWorklistOrNull())
525         worklist->completeAllForVM(*this);
526 #endif // ENABLE(JIT)
527
528 #if ENABLE(DFG_JIT)
529     // Make sure concurrent compilations are done, but don't install them, since there is
530     // no point to doing so.
531     for (unsigned i = DFG::numberOfWorklists(); i--;) {
532         if (DFG::Worklist* worklist = DFG::existingWorklistForIndexOrNull(i)) {
533             worklist->removeNonCompilingPlansForVM(*this);
534             worklist->waitUntilAllPlansForVMAreReady(*this);
535             worklist->removeAllReadyPlansForVM(*this);
536         }
537     }
538 #endif // ENABLE(DFG_JIT)
539     
540     waitForAsynchronousDisassembly();
541     
542     // Clear this first to ensure that nobody tries to remove themselves from it.
543     m_perBytecodeProfiler = nullptr;
544
545     ASSERT(currentThreadIsHoldingAPILock());
546     m_apiLock->willDestroyVM(this);
547     smallStrings.setIsInitialized(false);
548     heap.lastChanceToFinalize();
549
550     JSRunLoopTimer::Manager::shared().unregisterVM(*this);
551     
552     delete interpreter;
553 #ifndef NDEBUG
554     interpreter = reinterpret_cast<Interpreter*>(0xbbadbeef);
555 #endif
556
557     delete emptyList;
558
559     delete propertyNames;
560     if (vmType != Default)
561         delete m_atomicStringTable;
562
563     delete clientData;
564     delete m_regExpCache;
565
566 #if ENABLE(REGEXP_TRACING)
567     delete m_rtTraceList;
568 #endif
569
570 #if ENABLE(DFG_JIT)
571     for (unsigned i = 0; i < m_scratchBuffers.size(); ++i)
572         fastFree(m_scratchBuffers[i]);
573 #endif
574 }
575
576 void VM::primitiveGigacageDisabledCallback(void* argument)
577 {
578     static_cast<VM*>(argument)->primitiveGigacageDisabled();
579 }
580
581 void VM::primitiveGigacageDisabled()
582 {
583     if (m_apiLock->currentThreadIsHoldingLock()) {
584         m_primitiveGigacageEnabled.fireAll(*this, "Primitive gigacage disabled");
585         return;
586     }
587  
588     // This is totally racy, and that's OK. The point is, it's up to the user to ensure that they pass the
589     // uncaged buffer in a nicely synchronized manner.
590     m_needToFirePrimitiveGigacageEnabled = true;
591 }
592
593 void VM::setLastStackTop(void* lastStackTop)
594
595     m_lastStackTop = lastStackTop;
596 }
597
598 Ref<VM> VM::createContextGroup(HeapType heapType)
599 {
600     return adoptRef(*new VM(APIContextGroup, heapType));
601 }
602
603 Ref<VM> VM::create(HeapType heapType)
604 {
605     return adoptRef(*new VM(Default, heapType));
606 }
607
608 bool VM::sharedInstanceExists()
609 {
610     return sharedInstanceInternal();
611 }
612
613 VM& VM::sharedInstance()
614 {
615     GlobalJSLock globalLock;
616     VM*& instance = sharedInstanceInternal();
617     if (!instance)
618         instance = adoptRef(new VM(APIShared, SmallHeap)).leakRef();
619     return *instance;
620 }
621
622 VM*& VM::sharedInstanceInternal()
623 {
624     static VM* sharedInstance;
625     return sharedInstance;
626 }
627
628 Watchdog& VM::ensureWatchdog()
629 {
630     if (!m_watchdog)
631         m_watchdog = adoptRef(new Watchdog(this));
632     return *m_watchdog;
633 }
634
635 HeapProfiler& VM::ensureHeapProfiler()
636 {
637     if (!m_heapProfiler)
638         m_heapProfiler = std::make_unique<HeapProfiler>(*this);
639     return *m_heapProfiler;
640 }
641
642 #if ENABLE(SAMPLING_PROFILER)
643 SamplingProfiler& VM::ensureSamplingProfiler(RefPtr<Stopwatch>&& stopwatch)
644 {
645     if (!m_samplingProfiler)
646         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
647     return *m_samplingProfiler;
648 }
649 #endif // ENABLE(SAMPLING_PROFILER)
650
651 #if ENABLE(JIT)
652 static ThunkGenerator thunkGeneratorForIntrinsic(Intrinsic intrinsic)
653 {
654     switch (intrinsic) {
655     case CharCodeAtIntrinsic:
656         return charCodeAtThunkGenerator;
657     case CharAtIntrinsic:
658         return charAtThunkGenerator;
659     case Clz32Intrinsic:
660         return clz32ThunkGenerator;
661     case FromCharCodeIntrinsic:
662         return fromCharCodeThunkGenerator;
663     case SqrtIntrinsic:
664         return sqrtThunkGenerator;
665     case AbsIntrinsic:
666         return absThunkGenerator;
667     case FloorIntrinsic:
668         return floorThunkGenerator;
669     case CeilIntrinsic:
670         return ceilThunkGenerator;
671     case TruncIntrinsic:
672         return truncThunkGenerator;
673     case RoundIntrinsic:
674         return roundThunkGenerator;
675     case ExpIntrinsic:
676         return expThunkGenerator;
677     case LogIntrinsic:
678         return logThunkGenerator;
679     case IMulIntrinsic:
680         return imulThunkGenerator;
681     case RandomIntrinsic:
682         return randomThunkGenerator;
683     case BoundThisNoArgsFunctionCallIntrinsic:
684         return boundThisNoArgsFunctionCallGenerator;
685     default:
686         return nullptr;
687     }
688 }
689
690 #endif // ENABLE(JIT)
691
692 NativeExecutable* VM::getHostFunction(NativeFunction function, NativeFunction constructor, const String& name)
693 {
694     return getHostFunction(function, NoIntrinsic, constructor, nullptr, name);
695 }
696
697 static Ref<NativeJITCode> jitCodeForCallTrampoline()
698 {
699     static NativeJITCode* result;
700     static std::once_flag onceKey;
701     std::call_once(onceKey, [&] {
702         result = new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_call_trampoline), JITCode::HostCallThunk, NoIntrinsic);
703     });
704     return makeRef(*result);
705 }
706
707 static Ref<NativeJITCode> jitCodeForConstructTrampoline()
708 {
709     static NativeJITCode* result;
710     static std::once_flag onceKey;
711     std::call_once(onceKey, [&] {
712         result = new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_construct_trampoline), JITCode::HostCallThunk, NoIntrinsic);
713     });
714     return makeRef(*result);
715 }
716
717 NativeExecutable* VM::getHostFunction(NativeFunction function, Intrinsic intrinsic, NativeFunction constructor, const DOMJIT::Signature* signature, const String& name)
718 {
719 #if ENABLE(JIT)
720     if (canUseJIT()) {
721         return jitStubs->hostFunctionStub(
722             this, function, constructor,
723             intrinsic != NoIntrinsic ? thunkGeneratorForIntrinsic(intrinsic) : 0,
724             intrinsic, signature, name);
725     }
726 #endif // ENABLE(JIT)
727     UNUSED_PARAM(intrinsic);
728     UNUSED_PARAM(signature);
729     return NativeExecutable::create(*this, jitCodeForCallTrampoline(), function, jitCodeForConstructTrampoline(), constructor, name);
730 }
731
732 MacroAssemblerCodePtr<JSEntryPtrTag> VM::getCTIInternalFunctionTrampolineFor(CodeSpecializationKind kind)
733 {
734 #if ENABLE(JIT)
735     if (canUseJIT()) {
736         if (kind == CodeForCall)
737             return jitStubs->ctiInternalFunctionCall(this).retagged<JSEntryPtrTag>();
738         return jitStubs->ctiInternalFunctionConstruct(this).retagged<JSEntryPtrTag>();
739     }
740 #endif
741     if (kind == CodeForCall)
742         return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_call_trampoline);
743     return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_construct_trampoline);
744 }
745
746 VM::ClientData::~ClientData()
747 {
748 }
749
750 void VM::resetDateCache()
751 {
752     localTimeOffsetCache.reset();
753     cachedDateString = String();
754     cachedDateStringValue = std::numeric_limits<double>::quiet_NaN();
755     dateInstanceCache.reset();
756 }
757
758 void VM::whenIdle(Function<void()>&& callback)
759 {
760     if (!entryScope) {
761         callback();
762         return;
763     }
764
765     entryScope->addDidPopListener(WTFMove(callback));
766 }
767
768 void VM::deleteAllLinkedCode(DeleteAllCodeEffort effort)
769 {
770     whenIdle([=] () {
771         heap.deleteAllCodeBlocks(effort);
772     });
773 }
774
775 void VM::deleteAllCode(DeleteAllCodeEffort effort)
776 {
777     whenIdle([=] () {
778         m_codeCache->clear();
779         m_regExpCache->deleteAllCode();
780         heap.deleteAllCodeBlocks(effort);
781         heap.deleteAllUnlinkedCodeBlocks(effort);
782         heap.reportAbandonedObjectGraph();
783     });
784 }
785
786 void VM::shrinkFootprintWhenIdle()
787 {
788     whenIdle([=] () {
789         sanitizeStackForVM(this);
790         deleteAllCode(DeleteAllCodeIfNotCollecting);
791         heap.collectNow(Synchronousness::Sync, CollectionScope::Full);
792         // FIXME: Consider stopping various automatic threads here.
793         // https://bugs.webkit.org/show_bug.cgi?id=185447
794         WTF::releaseFastMallocFreeMemory();
795     });
796 }
797
798 SourceProviderCache* VM::addSourceProviderCache(SourceProvider* sourceProvider)
799 {
800     auto addResult = sourceProviderCacheMap.add(sourceProvider, nullptr);
801     if (addResult.isNewEntry)
802         addResult.iterator->value = adoptRef(new SourceProviderCache);
803     return addResult.iterator->value.get();
804 }
805
806 void VM::clearSourceProviderCaches()
807 {
808     sourceProviderCacheMap.clear();
809 }
810
811 Exception* VM::throwException(ExecState* exec, Exception* exception)
812 {
813     ASSERT(exec == topCallFrame || exec->isGlobalExec() || exec == exec->lexicalGlobalObject()->callFrameAtDebuggerEntry());
814     CallFrame* throwOriginFrame = exec->isGlobalExec() ? exec : topJSCallFrame();
815
816     if (Options::breakOnThrow()) {
817         CodeBlock* codeBlock = throwOriginFrame ? throwOriginFrame->codeBlock() : nullptr;
818         dataLog("Throwing exception in call frame ", RawPointer(throwOriginFrame), " for code block ", codeBlock, "\n");
819         CRASH();
820     }
821
822     interpreter->notifyDebuggerOfExceptionToBeThrown(*this, throwOriginFrame, exception);
823
824     setException(exception);
825
826 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
827     m_nativeStackTraceOfLastThrow = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
828     m_throwingThread = &Thread::current();
829 #endif
830     return exception;
831 }
832
833 Exception* VM::throwException(ExecState* exec, JSValue thrownValue)
834 {
835     VM& vm = *this;
836     Exception* exception = jsDynamicCast<Exception*>(vm, thrownValue);
837     if (!exception)
838         exception = Exception::create(*this, thrownValue);
839
840     return throwException(exec, exception);
841 }
842
843 Exception* VM::throwException(ExecState* exec, JSObject* error)
844 {
845     return throwException(exec, JSValue(error));
846 }
847
848 void VM::setStackPointerAtVMEntry(void* sp)
849 {
850     m_stackPointerAtVMEntry = sp;
851     updateStackLimits();
852 }
853
854 size_t VM::updateSoftReservedZoneSize(size_t softReservedZoneSize)
855 {
856     size_t oldSoftReservedZoneSize = m_currentSoftReservedZoneSize;
857     m_currentSoftReservedZoneSize = softReservedZoneSize;
858 #if ENABLE(C_LOOP)
859     interpreter->cloopStack().setSoftReservedZoneSize(softReservedZoneSize);
860 #endif
861
862     updateStackLimits();
863
864     return oldSoftReservedZoneSize;
865 }
866
867 #if OS(WINDOWS)
868 // On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
869 // where the guard page is a barrier between committed and uncommitted memory.
870 // When data from the guard page is read or written, the guard page is moved, and memory is committed.
871 // This is how the system grows the stack.
872 // When using the C stack on Windows we need to precommit the needed stack space.
873 // Otherwise we might crash later if we access uncommitted stack memory.
874 // This can happen if we allocate stack space larger than the page guard size (4K).
875 // The system does not get the chance to move the guard page, and commit more memory,
876 // and we crash if uncommitted memory is accessed.
877 // The MSVC compiler fixes this by inserting a call to the _chkstk() function,
878 // when needed, see http://support.microsoft.com/kb/100775.
879 // By touching every page up to the stack limit with a dummy operation,
880 // we force the system to move the guard page, and commit memory.
881
882 static void preCommitStackMemory(void* stackLimit)
883 {
884     const int pageSize = 4096;
885     for (volatile char* p = reinterpret_cast<char*>(&stackLimit); p > stackLimit; p -= pageSize) {
886         char ch = *p;
887         *p = ch;
888     }
889 }
890 #endif
891
892 inline void VM::updateStackLimits()
893 {
894 #if OS(WINDOWS)
895     void* lastSoftStackLimit = m_softStackLimit;
896 #endif
897
898     const StackBounds& stack = Thread::current().stack();
899     size_t reservedZoneSize = Options::reservedZoneSize();
900     // We should have already ensured that Options::reservedZoneSize() >= minimumReserveZoneSize at
901     // options initialization time, and the option value should not have been changed thereafter.
902     // We don't have the ability to assert here that it hasn't changed, but we can at least assert
903     // that the value is sane.
904     RELEASE_ASSERT(reservedZoneSize >= minimumReservedZoneSize);
905
906     if (m_stackPointerAtVMEntry) {
907         ASSERT(stack.isGrowingDownward());
908         char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
909         m_softStackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), m_currentSoftReservedZoneSize);
910         m_stackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), reservedZoneSize);
911     } else {
912         m_softStackLimit = stack.recursionLimit(m_currentSoftReservedZoneSize);
913         m_stackLimit = stack.recursionLimit(reservedZoneSize);
914     }
915
916 #if OS(WINDOWS)
917     // We only need to precommit stack memory dictated by the VM::m_softStackLimit limit.
918     // This is because VM::m_softStackLimit applies to stack usage by LLINT asm or JIT
919     // generated code which can allocate stack space that the C++ compiler does not know
920     // about. As such, we have to precommit that stack memory manually.
921     //
922     // In contrast, we do not need to worry about VM::m_stackLimit because that limit is
923     // used exclusively by C++ code, and the C++ compiler will automatically commit the
924     // needed stack pages.
925     if (lastSoftStackLimit != m_softStackLimit)
926         preCommitStackMemory(m_softStackLimit);
927 #endif
928 }
929
930 #if ENABLE(DFG_JIT)
931 void VM::gatherScratchBufferRoots(ConservativeRoots& conservativeRoots)
932 {
933     auto lock = holdLock(m_scratchBufferLock);
934     for (auto* scratchBuffer : m_scratchBuffers) {
935         if (scratchBuffer->activeLength()) {
936             void* bufferStart = scratchBuffer->dataBuffer();
937             conservativeRoots.add(bufferStart, static_cast<void*>(static_cast<char*>(bufferStart) + scratchBuffer->activeLength()));
938         }
939     }
940 }
941 #endif
942
943 void logSanitizeStack(VM* vm)
944 {
945     if (Options::verboseSanitizeStack() && vm->topCallFrame) {
946         int dummy;
947         auto& stackBounds = Thread::current().stack();
948         dataLog(
949             "Sanitizing stack for VM = ", RawPointer(vm), " with top call frame at ", RawPointer(vm->topCallFrame),
950             ", current stack pointer at ", RawPointer(&dummy), ", in ",
951             pointerDump(vm->topCallFrame->codeBlock()), ", last code origin = ",
952             vm->topCallFrame->codeOrigin(), ", last stack top = ", RawPointer(vm->lastStackTop()), ", in stack range [", RawPointer(stackBounds.origin()), ", ", RawPointer(stackBounds.end()), "]\n");
953     }
954 }
955
956 #if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
957 char* VM::acquireRegExpPatternContexBuffer()
958 {
959     m_regExpPatternContextLock.lock();
960     ASSERT(m_regExpPatternContextLock.isLocked());
961     if (!m_regExpPatternContexBuffer)
962         m_regExpPatternContexBuffer = makeUniqueArray<char>(VM::patternContextBufferSize);
963     return m_regExpPatternContexBuffer.get();
964 }
965
966 void VM::releaseRegExpPatternContexBuffer()
967 {
968     ASSERT(m_regExpPatternContextLock.isLocked());
969
970     m_regExpPatternContextLock.unlock();
971 }
972 #endif
973
974 #if ENABLE(REGEXP_TRACING)
975 void VM::addRegExpToTrace(RegExp* regExp)
976 {
977     gcProtect(regExp);
978     m_rtTraceList->add(regExp);
979 }
980
981 void VM::dumpRegExpTrace()
982 {
983     // The first RegExp object is ignored.  It is create by the RegExpPrototype ctor and not used.
984     RTTraceList::iterator iter = ++m_rtTraceList->begin();
985     
986     if (iter != m_rtTraceList->end()) {
987         dataLogF("\nRegExp Tracing\n");
988         dataLogF("Regular Expression                              8 Bit          16 Bit        match()    Matches    Average\n");
989         dataLogF(" <Match only / Match>                         JIT Addr      JIT Address       calls      found   String len\n");
990         dataLogF("----------------------------------------+----------------+----------------+----------+----------+-----------\n");
991     
992         unsigned reCount = 0;
993     
994         for (; iter != m_rtTraceList->end(); ++iter, ++reCount) {
995             (*iter)->printTraceData();
996             gcUnprotect(*iter);
997         }
998
999         dataLogF("%d Regular Expressions\n", reCount);
1000     }
1001     
1002     m_rtTraceList->clear();
1003 }
1004 #else
1005 void VM::dumpRegExpTrace()
1006 {
1007 }
1008 #endif
1009
1010 WatchpointSet* VM::ensureWatchpointSetForImpureProperty(const Identifier& propertyName)
1011 {
1012     auto result = m_impurePropertyWatchpointSets.add(propertyName.string(), nullptr);
1013     if (result.isNewEntry)
1014         result.iterator->value = adoptRef(new WatchpointSet(IsWatched));
1015     return result.iterator->value.get();
1016 }
1017
1018 void VM::registerWatchpointForImpureProperty(const Identifier& propertyName, Watchpoint* watchpoint)
1019 {
1020     ensureWatchpointSetForImpureProperty(propertyName)->add(watchpoint);
1021 }
1022
1023 void VM::addImpureProperty(const String& propertyName)
1024 {
1025     if (RefPtr<WatchpointSet> watchpointSet = m_impurePropertyWatchpointSets.take(propertyName))
1026         watchpointSet->fireAll(*this, "Impure property added");
1027 }
1028
1029 template<typename Func>
1030 static bool enableProfilerWithRespectToCount(unsigned& counter, const Func& doEnableWork)
1031 {
1032     bool needsToRecompile = false;
1033     if (!counter) {
1034         doEnableWork();
1035         needsToRecompile = true;
1036     }
1037     counter++;
1038
1039     return needsToRecompile;
1040 }
1041
1042 template<typename Func>
1043 static bool disableProfilerWithRespectToCount(unsigned& counter, const Func& doDisableWork)
1044 {
1045     RELEASE_ASSERT(counter > 0);
1046     bool needsToRecompile = false;
1047     counter--;
1048     if (!counter) {
1049         doDisableWork();
1050         needsToRecompile = true;
1051     }
1052
1053     return needsToRecompile;
1054 }
1055
1056 bool VM::enableTypeProfiler()
1057 {
1058     auto enableTypeProfiler = [this] () {
1059         this->m_typeProfiler = std::make_unique<TypeProfiler>();
1060         this->m_typeProfilerLog = std::make_unique<TypeProfilerLog>(*this);
1061     };
1062
1063     return enableProfilerWithRespectToCount(m_typeProfilerEnabledCount, enableTypeProfiler);
1064 }
1065
1066 bool VM::disableTypeProfiler()
1067 {
1068     auto disableTypeProfiler = [this] () {
1069         this->m_typeProfiler.reset(nullptr);
1070         this->m_typeProfilerLog.reset(nullptr);
1071     };
1072
1073     return disableProfilerWithRespectToCount(m_typeProfilerEnabledCount, disableTypeProfiler);
1074 }
1075
1076 bool VM::enableControlFlowProfiler()
1077 {
1078     auto enableControlFlowProfiler = [this] () {
1079         this->m_controlFlowProfiler = std::make_unique<ControlFlowProfiler>();
1080     };
1081
1082     return enableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, enableControlFlowProfiler);
1083 }
1084
1085 bool VM::disableControlFlowProfiler()
1086 {
1087     auto disableControlFlowProfiler = [this] () {
1088         this->m_controlFlowProfiler.reset(nullptr);
1089     };
1090
1091     return disableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, disableControlFlowProfiler);
1092 }
1093
1094 void VM::dumpTypeProfilerData()
1095 {
1096     if (!typeProfiler())
1097         return;
1098
1099     typeProfilerLog()->processLogEntries(*this, "VM Dump Types"_s);
1100     typeProfiler()->dumpTypeProfilerData(*this);
1101 }
1102
1103 void VM::queueMicrotask(JSGlobalObject& globalObject, Ref<Microtask>&& task)
1104 {
1105     m_microtaskQueue.append(std::make_unique<QueuedTask>(*this, &globalObject, WTFMove(task)));
1106 }
1107
1108 void VM::drainMicrotasks()
1109 {
1110     while (!m_microtaskQueue.isEmpty()) {
1111         m_microtaskQueue.takeFirst()->run();
1112         if (m_onEachMicrotaskTick)
1113             m_onEachMicrotaskTick(*this);
1114     }
1115 }
1116
1117 void QueuedTask::run()
1118 {
1119     m_microtask->run(m_globalObject->globalExec());
1120 }
1121
1122 void sanitizeStackForVM(VM* vm)
1123 {
1124     logSanitizeStack(vm);
1125     if (vm->topCallFrame) {
1126         auto& stackBounds = Thread::current().stack();
1127         ASSERT(vm->currentThreadIsHoldingAPILock());
1128         ASSERT_UNUSED(stackBounds, stackBounds.contains(vm->lastStackTop()));
1129     }
1130 #if ENABLE(C_LOOP)
1131     vm->interpreter->cloopStack().sanitizeStack();
1132 #else
1133     sanitizeStackForVMImpl(vm);
1134 #endif
1135 }
1136
1137 size_t VM::committedStackByteCount()
1138 {
1139 #if !ENABLE(C_LOOP)
1140     // When using the C stack, we don't know how many stack pages are actually
1141     // committed. So, we use the current stack usage as an estimate.
1142     ASSERT(Thread::current().stack().isGrowingDownward());
1143     uint8_t* current = bitwise_cast<uint8_t*>(currentStackPointer());
1144     uint8_t* high = bitwise_cast<uint8_t*>(Thread::current().stack().origin());
1145     return high - current;
1146 #else
1147     return CLoopStack::committedByteCount();
1148 #endif
1149 }
1150
1151 #if ENABLE(C_LOOP)
1152 bool VM::ensureStackCapacityForCLoop(Register* newTopOfStack)
1153 {
1154     return interpreter->cloopStack().ensureCapacityFor(newTopOfStack);
1155 }
1156
1157 bool VM::isSafeToRecurseSoftCLoop() const
1158 {
1159     return interpreter->cloopStack().isSafeToRecurse();
1160 }
1161 #endif // ENABLE(C_LOOP)
1162
1163 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
1164 void VM::verifyExceptionCheckNeedIsSatisfied(unsigned recursionDepth, ExceptionEventLocation& location)
1165 {
1166     if (!Options::validateExceptionChecks())
1167         return;
1168
1169     if (UNLIKELY(m_needExceptionCheck)) {
1170         auto throwDepth = m_simulatedThrowPointRecursionDepth;
1171         auto& throwLocation = m_simulatedThrowPointLocation;
1172
1173         dataLog(
1174             "ERROR: Unchecked JS exception:\n"
1175             "    This scope can throw a JS exception: ", throwLocation, "\n"
1176             "        (ExceptionScope::m_recursionDepth was ", throwDepth, ")\n"
1177             "    But the exception was unchecked as of this scope: ", location, "\n"
1178             "        (ExceptionScope::m_recursionDepth was ", recursionDepth, ")\n"
1179             "\n");
1180
1181         StringPrintStream out;
1182         std::unique_ptr<StackTrace> currentTrace = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
1183
1184         if (Options::dumpSimulatedThrows()) {
1185             out.println("The simulated exception was thrown at:");
1186             m_nativeStackTraceOfLastSimulatedThrow->dump(out, "    ");
1187             out.println();
1188         }
1189         out.println("Unchecked exception detected at:");
1190         currentTrace->dump(out, "    ");
1191         out.println();
1192
1193         dataLog(out.toCString());
1194         RELEASE_ASSERT(!m_needExceptionCheck);
1195     }
1196 }
1197 #endif
1198
1199 #if USE(CF)
1200 void VM::setRunLoop(CFRunLoopRef runLoop)
1201 {
1202     ASSERT(runLoop);
1203     m_runLoop = runLoop;
1204     JSRunLoopTimer::Manager::shared().didChangeRunLoop(*this, runLoop);
1205 }
1206 #endif // USE(CF)
1207
1208 ScratchBuffer* VM::scratchBufferForSize(size_t size)
1209 {
1210     if (!size)
1211         return nullptr;
1212
1213     auto locker = holdLock(m_scratchBufferLock);
1214
1215     if (size > m_sizeOfLastScratchBuffer) {
1216         // Protect against a N^2 memory usage pathology by ensuring
1217         // that at worst, we get a geometric series, meaning that the
1218         // total memory usage is somewhere around
1219         // max(scratch buffer size) * 4.
1220         m_sizeOfLastScratchBuffer = size * 2;
1221
1222         ScratchBuffer* newBuffer = ScratchBuffer::create(m_sizeOfLastScratchBuffer);
1223         RELEASE_ASSERT(newBuffer);
1224         m_scratchBuffers.append(newBuffer);
1225     }
1226
1227     ScratchBuffer* result = m_scratchBuffers.last();
1228     return result;
1229 }
1230
1231 void VM::clearScratchBuffers()
1232 {
1233     auto lock = holdLock(m_scratchBufferLock);
1234     for (auto* scratchBuffer : m_scratchBuffers)
1235         scratchBuffer->setActiveLength(0);
1236 }
1237
1238 void VM::ensureShadowChicken()
1239 {
1240     if (m_shadowChicken)
1241         return;
1242     m_shadowChicken = std::make_unique<ShadowChicken>();
1243 }
1244
1245 #define DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(name, heapCellType, type) \
1246     IsoSubspace* VM::name##Slow() \
1247     { \
1248         ASSERT(!m_##name); \
1249         auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, heapCellType, type); \
1250         WTF::storeStoreFence(); \
1251         m_##name = WTFMove(space); \
1252         return m_##name.get(); \
1253     }
1254
1255
1256 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, cellHeapCellType.get(), JSBoundFunction)
1257 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, destructibleObjectHeapCellType.get(), JSCallbackFunction)
1258 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterSetterFunctionSpace, cellHeapCellType.get(), JSCustomGetterSetterFunction)
1259 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, destructibleObjectHeapCellType.get(), ErrorInstance)
1260 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, cellHeapCellType.get(), JSNativeStdFunction)
1261 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, destructibleObjectHeapCellType.get(), ProxyRevoke)
1262 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, destructibleObjectHeapCellType.get(), JSWeakMap)
1263 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, destructibleObjectHeapCellType.get(), JSWeakSet)
1264 #if JSC_OBJC_API_ENABLED
1265 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, destructibleObjectHeapCellType.get(), ObjCCallbackFunction)
1266 #endif
1267 #if ENABLE(WEBASSEMBLY)
1268 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock)
1269 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, webAssemblyFunctionHeapCellType.get(), WebAssemblyFunction)
1270 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyWrapperFunctionSpace, cellHeapCellType.get(), WebAssemblyWrapperFunction)
1271 #endif
1272
1273 #undef DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW
1274
1275 #define DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(name, heapCellType, type) \
1276     IsoSubspace* VM::name##Slow() \
1277     { \
1278         ASSERT(!m_##name); \
1279         auto space = std::make_unique<SpaceAndSet> ISO_SUBSPACE_INIT(heap, heapCellType, type); \
1280         WTF::storeStoreFence(); \
1281         m_##name = WTFMove(space); \
1282         return &m_##name->space; \
1283     }
1284
1285 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(inferredValueSpace, destructibleCellHeapCellType.get(), InferredValue)
1286 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(evalExecutableSpace, destructibleCellHeapCellType.get(), EvalExecutable)
1287 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(moduleProgramExecutableSpace, destructibleCellHeapCellType.get(), ModuleProgramExecutable)
1288
1289 #undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW
1290
1291 Structure* VM::setIteratorStructureSlow()
1292 {
1293     ASSERT(!m_setIteratorStructure);
1294     m_setIteratorStructure.set(*this, JSSetIterator::createStructure(*this, 0, jsNull()));
1295     return m_setIteratorStructure.get();
1296 }
1297
1298 Structure* VM::mapIteratorStructureSlow()
1299 {
1300     ASSERT(!m_mapIteratorStructure);
1301     m_mapIteratorStructure.set(*this, JSMapIterator::createStructure(*this, 0, jsNull()));
1302     return m_mapIteratorStructure.get();
1303 }
1304
1305 JSCell* VM::sentinelSetBucketSlow()
1306 {
1307     ASSERT(!m_sentinelSetBucket);
1308     auto* sentinel = JSSet::BucketType::createSentinel(*this);
1309     m_sentinelSetBucket.set(*this, sentinel);
1310     return sentinel;
1311 }
1312
1313 JSCell* VM::sentinelMapBucketSlow()
1314 {
1315     ASSERT(!m_sentinelMapBucket);
1316     auto* sentinel = JSMap::BucketType::createSentinel(*this);
1317     m_sentinelMapBucket.set(*this, sentinel);
1318     return sentinel;
1319 }
1320
1321 JSGlobalObject* VM::vmEntryGlobalObject(const CallFrame* callFrame) const
1322 {
1323     if (callFrame && callFrame->isGlobalExec()) {
1324         ASSERT(callFrame->callee().isCell() && callFrame->callee().asCell()->isObject());
1325         ASSERT(callFrame == callFrame->lexicalGlobalObject()->globalExec());
1326         return callFrame->lexicalGlobalObject();
1327     }
1328     ASSERT(entryScope);
1329     return entryScope->globalObject();
1330 }
1331
1332 void VM::setCrashOnVMCreation(bool shouldCrash)
1333 {
1334     vmCreationShouldCrash = shouldCrash;
1335 }
1336
1337 } // namespace JSC