[JSC] Lazily create sentinel Map and Set buckets
[WebKit-https.git] / Source / JavaScriptCore / runtime / VM.cpp
1 /*
2  * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer. 
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution. 
13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission. 
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28
29 #include "config.h"
30 #include "VM.h"
31
32 #include "ArgList.h"
33 #include "ArrayBufferNeuteringWatchpoint.h"
34 #include "BuiltinExecutables.h"
35 #include "BytecodeIntrinsicRegistry.h"
36 #include "CodeBlock.h"
37 #include "CodeCache.h"
38 #include "CommonIdentifiers.h"
39 #include "CommonSlowPaths.h"
40 #include "CustomGetterSetter.h"
41 #include "DFGWorklist.h"
42 #include "DirectEvalExecutable.h"
43 #include "Disassembler.h"
44 #include "Error.h"
45 #include "ErrorConstructor.h"
46 #include "ErrorInstance.h"
47 #include "EvalCodeBlock.h"
48 #include "Exception.h"
49 #include "ExecutableToCodeBlockEdge.h"
50 #include "FTLThunks.h"
51 #include "FastMallocAlignedMemoryAllocator.h"
52 #include "FunctionCodeBlock.h"
53 #include "FunctionConstructor.h"
54 #include "FunctionExecutable.h"
55 #include "GCActivityCallback.h"
56 #include "GetterSetter.h"
57 #include "GigacageAlignedMemoryAllocator.h"
58 #include "HasOwnPropertyCache.h"
59 #include "Heap.h"
60 #include "HeapIterationScope.h"
61 #include "HeapProfiler.h"
62 #include "HostCallReturnValue.h"
63 #include "Identifier.h"
64 #include "IncrementalSweeper.h"
65 #include "IndirectEvalExecutable.h"
66 #include "InferredValue.h"
67 #include "Interpreter.h"
68 #include "IntlCollatorConstructor.h"
69 #include "IntlDateTimeFormatConstructor.h"
70 #include "IntlNumberFormatConstructor.h"
71 #include "IntlPluralRulesConstructor.h"
72 #include "JITCode.h"
73 #include "JITWorklist.h"
74 #include "JSAPIValueWrapper.h"
75 #include "JSArray.h"
76 #include "JSArrayBufferConstructor.h"
77 #include "JSAsyncFunction.h"
78 #include "JSBigInt.h"
79 #include "JSBoundFunction.h"
80 #include "JSCInlines.h"
81 #include "JSCallbackFunction.h"
82 #include "JSCustomGetterSetterFunction.h"
83 #include "JSDestructibleObjectHeapCellType.h"
84 #include "JSFixedArray.h"
85 #include "JSFunction.h"
86 #include "JSGlobalObjectFunctions.h"
87 #include "JSImmutableButterfly.h"
88 #include "JSInternalPromiseDeferred.h"
89 #include "JSLock.h"
90 #include "JSMap.h"
91 #include "JSMapIterator.h"
92 #include "JSPromiseDeferred.h"
93 #include "JSPropertyNameEnumerator.h"
94 #include "JSSegmentedVariableObjectHeapCellType.h"
95 #include "JSScriptFetchParameters.h"
96 #include "JSScriptFetcher.h"
97 #include "JSSet.h"
98 #include "JSSetIterator.h"
99 #include "JSSourceCode.h"
100 #include "JSStringHeapCellType.h"
101 #include "JSTemplateObjectDescriptor.h"
102 #include "JSWeakMap.h"
103 #include "JSWeakSet.h"
104 #include "JSWebAssembly.h"
105 #include "JSWebAssemblyCodeBlock.h"
106 #include "JSWebAssemblyCodeBlockHeapCellType.h"
107 #include "JSWithScope.h"
108 #include "LLIntData.h"
109 #include "Lexer.h"
110 #include "Lookup.h"
111 #include "MinimumReservedZoneSize.h"
112 #include "ModuleProgramCodeBlock.h"
113 #include "ModuleProgramExecutable.h"
114 #include "NativeErrorConstructor.h"
115 #include "NativeExecutable.h"
116 #include "NativeStdFunctionCell.h"
117 #include "Nodes.h"
118 #include "ObjCCallbackFunction.h"
119 #include "Parser.h"
120 #include "ProfilerDatabase.h"
121 #include "ProgramCodeBlock.h"
122 #include "ProgramExecutable.h"
123 #include "PromiseDeferredTimer.h"
124 #include "PropertyMapHashTable.h"
125 #include "ProxyRevoke.h"
126 #include "RegExpCache.h"
127 #include "RegExpObject.h"
128 #include "RegisterAtOffsetList.h"
129 #include "RuntimeType.h"
130 #include "SamplingProfiler.h"
131 #include "ShadowChicken.h"
132 #include "SimpleTypedArrayController.h"
133 #include "SourceProviderCache.h"
134 #include "StackVisitor.h"
135 #include "StrictEvalActivation.h"
136 #include "StrongInlines.h"
137 #include "StructureInlines.h"
138 #include "TestRunnerUtils.h"
139 #include "ThunkGenerators.h"
140 #include "TypeProfiler.h"
141 #include "TypeProfilerLog.h"
142 #include "UnlinkedCodeBlock.h"
143 #include "VMEntryScope.h"
144 #include "VMInlines.h"
145 #include "VMInspector.h"
146 #include "VariableEnvironment.h"
147 #include "WasmWorklist.h"
148 #include "Watchdog.h"
149 #include "WeakGCMapInlines.h"
150 #include "WebAssemblyFunction.h"
151 #include "WebAssemblyWrapperFunction.h"
152 #include <wtf/ProcessID.h>
153 #include <wtf/ReadWriteLock.h>
154 #include <wtf/SimpleStats.h>
155 #include <wtf/StringPrintStream.h>
156 #include <wtf/Threading.h>
157 #include <wtf/text/AtomicStringTable.h>
158 #include <wtf/text/SymbolRegistry.h>
159
160 #if ENABLE(C_LOOP)
161 #include "CLoopStack.h"
162 #include "CLoopStackInlines.h"
163 #endif
164
165 #if ENABLE(DFG_JIT)
166 #include "ConservativeRoots.h"
167 #endif
168
169 #if ENABLE(REGEXP_TRACING)
170 #include "RegExp.h"
171 #endif
172
173 namespace JSC {
174
175 #if ENABLE(JIT)
176 #if !ASSERT_DISABLED
177 bool VM::s_canUseJITIsSet = false;
178 #endif
179 bool VM::s_canUseJIT = false;
180 #endif
181
182 Atomic<unsigned> VM::s_numberOfIDs;
183
184 // Note: Platform.h will enforce that ENABLE(ASSEMBLER) is true if either
185 // ENABLE(JIT) or ENABLE(YARR_JIT) or both are enabled. The code below
186 // just checks for ENABLE(JIT) or ENABLE(YARR_JIT) with this premise in mind.
187
188 #if ENABLE(ASSEMBLER)
189 static bool enableAssembler(ExecutableAllocator& executableAllocator)
190 {
191     if (!Options::useJIT() && !Options::useRegExpJIT())
192         return false;
193
194     if (!executableAllocator.isValid()) {
195         if (Options::crashIfCantAllocateJITMemory())
196             CRASH();
197         return false;
198     }
199
200     char* canUseJITString = getenv("JavaScriptCoreUseJIT");
201     return !canUseJITString || atoi(canUseJITString);
202 }
203 #endif // ENABLE(!ASSEMBLER)
204
205 bool VM::canUseAssembler()
206 {
207 #if ENABLE(ASSEMBLER)
208     static std::once_flag onceKey;
209     static bool enabled = false;
210     std::call_once(onceKey, [] {
211         enabled = enableAssembler(ExecutableAllocator::singleton());
212     });
213     return enabled;
214 #else
215     return false; // interpreter only
216 #endif
217 }
218
219 void VM::computeCanUseJIT()
220 {
221 #if ENABLE(JIT)
222 #if !ASSERT_DISABLED
223     RELEASE_ASSERT(!s_canUseJITIsSet);
224     s_canUseJITIsSet = true;
225 #endif
226     s_canUseJIT = VM::canUseAssembler() && Options::useJIT();
227 #endif
228 }
229
230 bool VM::canUseRegExpJIT()
231 {
232 #if ENABLE(YARR_JIT)
233     static std::once_flag onceKey;
234     static bool enabled = false;
235     std::call_once(onceKey, [] {
236         enabled = VM::canUseAssembler() && Options::useRegExpJIT();
237     });
238     return enabled;
239 #else
240     return false; // interpreter only
241 #endif
242 }
243
244 bool VM::isInMiniMode()
245 {
246     return !canUseJIT() || Options::forceMiniVMMode();
247 }
248
249 inline unsigned VM::nextID()
250 {
251     for (;;) {
252         unsigned currentNumberOfIDs = s_numberOfIDs.load();
253         unsigned newID = currentNumberOfIDs + 1;
254         if (s_numberOfIDs.compareExchangeWeak(currentNumberOfIDs, newID))
255             return newID;
256     }
257 }
258
259
260 VM::VM(VMType vmType, HeapType heapType)
261     : m_id(nextID())
262     , m_apiLock(adoptRef(new JSLock(this)))
263 #if USE(CF)
264     , m_runLoop(CFRunLoopGetCurrent())
265 #endif // USE(CF)
266     , heap(this, heapType)
267     , fastMallocAllocator(std::make_unique<FastMallocAlignedMemoryAllocator>())
268     , primitiveGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::Primitive))
269     , jsValueGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::JSValue))
270     , auxiliaryHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::Auxiliary)))
271     , immutableButterflyHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCellWithInteriorPointers)))
272     , cellHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
273     , destructibleCellHeapCellType(std::make_unique<HeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)))
274     , stringHeapCellType(std::make_unique<JSStringHeapCellType>())
275     , destructibleObjectHeapCellType(std::make_unique<JSDestructibleObjectHeapCellType>())
276     , segmentedVariableObjectHeapCellType(std::make_unique<JSSegmentedVariableObjectHeapCellType>())
277 #if ENABLE(WEBASSEMBLY)
278     , webAssemblyCodeBlockHeapCellType(std::make_unique<JSWebAssemblyCodeBlockHeapCellType>())
279 #endif
280     , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get())
281     , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get())
282     , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get())
283     , cellSpace("JSCell", heap, cellHeapCellType.get(), fastMallocAllocator.get())
284     , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellHeapCellType.get(), jsValueGigacageAllocator.get())
285     , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get())
286     , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get())
287     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
288     , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
289     , segmentedVariableObjectSpace("JSSegmentedVariableObjectSpace", heap, segmentedVariableObjectHeapCellType.get(), fastMallocAllocator.get())
290     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge)
291     , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction)
292     , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
293     , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable)
294     , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable)
295     , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData)
296     , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure)
297     , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
298     , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
299     , codeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), CodeBlock)
300     , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
301     , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable)
302     , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable)
303     , vmType(vmType)
304     , clientData(0)
305     , topEntryFrame(nullptr)
306     , topCallFrame(CallFrame::noCaller())
307     , promiseDeferredTimer(std::make_unique<PromiseDeferredTimer>(*this))
308     , m_atomicStringTable(vmType == Default ? Thread::current().atomicStringTable() : new AtomicStringTable)
309     , propertyNames(nullptr)
310     , emptyList(new ArgList)
311     , machineCodeBytesPerBytecodeWordForBaselineJIT(std::make_unique<SimpleStats>())
312     , customGetterSetterFunctionMap(*this)
313     , stringCache(*this)
314     , symbolImplToSymbolMap(*this)
315     , structureCache(*this)
316     , interpreter(0)
317     , entryScope(0)
318     , m_regExpCache(new RegExpCache(this))
319     , m_compactVariableMap(adoptRef(*(new CompactVariableMap)))
320 #if ENABLE(REGEXP_TRACING)
321     , m_rtTraceList(new RTTraceList())
322 #endif
323 #if ENABLE(GC_VALIDATION)
324     , m_initializingObjectClass(0)
325 #endif
326     , m_stackPointerAtVMEntry(0)
327     , m_codeCache(std::make_unique<CodeCache>())
328     , m_builtinExecutables(std::make_unique<BuiltinExecutables>(*this))
329     , m_typeProfilerEnabledCount(0)
330     , m_primitiveGigacageEnabled(IsWatched)
331     , m_controlFlowProfilerEnabledCount(0)
332 {
333     interpreter = new Interpreter(*this);
334     StackBounds stack = Thread::current().stack();
335     updateSoftReservedZoneSize(Options::softReservedZoneSize());
336     setLastStackTop(stack.origin());
337
338     JSRunLoopTimer::Manager::shared().registerVM(*this);
339
340     // Need to be careful to keep everything consistent here
341     JSLockHolder lock(this);
342     AtomicStringTable* existingEntryAtomicStringTable = Thread::current().setCurrentAtomicStringTable(m_atomicStringTable);
343     structureStructure.set(*this, Structure::createStructure(*this));
344     structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
345     stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
346
347     smallStrings.initializeCommonStrings(*this);
348
349     propertyNames = new CommonIdentifiers(this);
350     terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
351     propertyNameEnumeratorStructure.set(*this, JSPropertyNameEnumerator::createStructure(*this, 0, jsNull()));
352     customGetterSetterStructure.set(*this, CustomGetterSetter::createStructure(*this, 0, jsNull()));
353     domAttributeGetterSetterStructure.set(*this, DOMAttributeGetterSetter::createStructure(*this, 0, jsNull()));
354     scopedArgumentsTableStructure.set(*this, ScopedArgumentsTable::createStructure(*this, 0, jsNull()));
355     apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, 0, jsNull()));
356     nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, 0, jsNull()));
357     evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, 0, jsNull()));
358     programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, 0, jsNull()));
359     functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, 0, jsNull()));
360 #if ENABLE(WEBASSEMBLY)
361     webAssemblyCodeBlockStructure.set(*this, JSWebAssemblyCodeBlock::createStructure(*this, 0, jsNull()));
362 #endif
363     moduleProgramExecutableStructure.set(*this, ModuleProgramExecutable::createStructure(*this, 0, jsNull()));
364     regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
365     symbolStructure.set(*this, Symbol::createStructure(*this, 0, jsNull()));
366     symbolTableStructure.set(*this, SymbolTable::createStructure(*this, 0, jsNull()));
367     fixedArrayStructure.set(*this, JSFixedArray::createStructure(*this, 0, jsNull()));
368
369     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithInt32) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithInt32));
370     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithDouble) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithDouble));
371     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithContiguous) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithContiguous));
372
373     sourceCodeStructure.set(*this, JSSourceCode::createStructure(*this, 0, jsNull()));
374     scriptFetcherStructure.set(*this, JSScriptFetcher::createStructure(*this, 0, jsNull()));
375     scriptFetchParametersStructure.set(*this, JSScriptFetchParameters::createStructure(*this, 0, jsNull()));
376     structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
377     sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
378     templateObjectDescriptorStructure.set(*this, JSTemplateObjectDescriptor::createStructure(*this, 0, jsNull()));
379     arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpoint::createStructure(*this));
380     unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
381     unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
382     unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
383     unlinkedFunctionCodeBlockStructure.set(*this, UnlinkedFunctionCodeBlock::createStructure(*this, 0, jsNull()));
384     unlinkedModuleProgramCodeBlockStructure.set(*this, UnlinkedModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
385     propertyTableStructure.set(*this, PropertyTable::createStructure(*this, 0, jsNull()));
386     if (VM::canUseJIT())
387         inferredValueStructure.set(*this, InferredValue::createStructure(*this, 0, jsNull()));
388     functionRareDataStructure.set(*this, FunctionRareData::createStructure(*this, 0, jsNull()));
389     exceptionStructure.set(*this, Exception::createStructure(*this, 0, jsNull()));
390     promiseDeferredStructure.set(*this, JSPromiseDeferred::createStructure(*this, 0, jsNull()));
391     internalPromiseDeferredStructure.set(*this, JSInternalPromiseDeferred::createStructure(*this, 0, jsNull()));
392     nativeStdFunctionCellStructure.set(*this, NativeStdFunctionCell::createStructure(*this, 0, jsNull()));
393     programCodeBlockStructure.set(*this, ProgramCodeBlock::createStructure(*this, 0, jsNull()));
394     moduleProgramCodeBlockStructure.set(*this, ModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
395     evalCodeBlockStructure.set(*this, EvalCodeBlock::createStructure(*this, 0, jsNull()));
396     functionCodeBlockStructure.set(*this, FunctionCodeBlock::createStructure(*this, 0, jsNull()));
397     hashMapBucketSetStructure.set(*this, HashMapBucket<HashMapBucketDataKey>::createStructure(*this, 0, jsNull()));
398     hashMapBucketMapStructure.set(*this, HashMapBucket<HashMapBucketDataKeyValue>::createStructure(*this, 0, jsNull()));
399     setIteratorStructure.set(*this, JSSetIterator::createStructure(*this, 0, jsNull()));
400     mapIteratorStructure.set(*this, JSMapIterator::createStructure(*this, 0, jsNull()));
401     bigIntStructure.set(*this, JSBigInt::createStructure(*this, 0, jsNull()));
402     executableToCodeBlockEdgeStructure.set(*this, ExecutableToCodeBlockEdge::createStructure(*this, nullptr, jsNull()));
403
404     // Eagerly initialize constant cells since the concurrent compiler can access them.
405     if (canUseJIT()) {
406         sentinelMapBucket();
407         sentinelSetBucket();
408     }
409
410     Thread::current().setCurrentAtomicStringTable(existingEntryAtomicStringTable);
411
412 #if ENABLE(JIT)
413     jitStubs = std::make_unique<JITThunks>();
414 #endif
415
416 #if ENABLE(FTL_JIT)
417     ftlThunks = std::make_unique<FTL::Thunks>();
418 #endif // ENABLE(FTL_JIT)
419     
420 #if !ENABLE(C_LOOP)
421     initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
422 #endif
423     
424     Gigacage::addPrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
425
426     heap.notifyIsSafeToCollect();
427     
428     LLInt::Data::performAssertions(*this);
429     
430     if (UNLIKELY(Options::useProfiler())) {
431         m_perBytecodeProfiler = std::make_unique<Profiler::Database>(*this);
432
433         StringPrintStream pathOut;
434         const char* profilerPath = getenv("JSC_PROFILER_PATH");
435         if (profilerPath)
436             pathOut.print(profilerPath, "/");
437         pathOut.print("JSCProfile-", getCurrentProcessID(), "-", m_perBytecodeProfiler->databaseID(), ".json");
438         m_perBytecodeProfiler->registerToSaveAtExit(pathOut.toCString().data());
439     }
440
441     callFrameForCatch = nullptr;
442
443     // Initialize this last, as a free way of asserting that VM initialization itself
444     // won't use this.
445     m_typedArrayController = adoptRef(new SimpleTypedArrayController());
446
447     m_bytecodeIntrinsicRegistry = std::make_unique<BytecodeIntrinsicRegistry>(*this);
448
449     if (Options::useTypeProfiler())
450         enableTypeProfiler();
451     if (Options::useControlFlowProfiler())
452         enableControlFlowProfiler();
453 #if ENABLE(SAMPLING_PROFILER)
454     if (Options::useSamplingProfiler()) {
455         setShouldBuildPCToCodeOriginMapping();
456         Ref<Stopwatch> stopwatch = Stopwatch::create();
457         stopwatch->start();
458         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
459         if (Options::samplingProfilerPath())
460             m_samplingProfiler->registerForReportAtExit();
461         m_samplingProfiler->start();
462     }
463 #endif // ENABLE(SAMPLING_PROFILER)
464
465     if (Options::alwaysGeneratePCToCodeOriginMap())
466         setShouldBuildPCToCodeOriginMapping();
467
468     if (Options::watchdog()) {
469         Watchdog& watchdog = ensureWatchdog();
470         watchdog.setTimeLimit(Seconds::fromMilliseconds(Options::watchdog()));
471     }
472
473 #if ENABLE(JIT)
474     // Make sure that any stubs that the JIT is going to use are initialized in non-compilation threads.
475     if (canUseJIT()) {
476         getCTIInternalFunctionTrampolineFor(CodeForCall);
477         getCTIInternalFunctionTrampolineFor(CodeForConstruct);
478     }
479 #endif
480
481     if (!canUseJIT())
482         noJITValueProfileSingleton = std::make_unique<ValueProfile>(0);
483
484     if (Options::forceDebuggerBytecodeGeneration() || Options::alwaysUseShadowChicken())
485         ensureShadowChicken();
486
487     VMInspector::instance().add(this);
488 }
489
490 static ReadWriteLock s_destructionLock;
491
492 void waitForVMDestruction()
493 {
494     auto locker = holdLock(s_destructionLock.write());
495 }
496
497 VM::~VM()
498 {
499     auto destructionLocker = holdLock(s_destructionLock.read());
500     
501     Gigacage::removePrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
502     promiseDeferredTimer->stopRunningTasks();
503 #if ENABLE(WEBASSEMBLY)
504     if (Wasm::Worklist* worklist = Wasm::existingWorklistOrNull())
505         worklist->stopAllPlansForContext(wasmContext);
506 #endif
507     if (UNLIKELY(m_watchdog))
508         m_watchdog->willDestroyVM(this);
509     m_traps.willDestroyVM();
510     VMInspector::instance().remove(this);
511
512     // Never GC, ever again.
513     heap.incrementDeferralDepth();
514
515 #if ENABLE(SAMPLING_PROFILER)
516     if (m_samplingProfiler) {
517         m_samplingProfiler->reportDataToOptionFile();
518         m_samplingProfiler->shutdown();
519     }
520 #endif // ENABLE(SAMPLING_PROFILER)
521     
522 #if ENABLE(JIT)
523     if (JITWorklist* worklist = JITWorklist::existingGlobalWorklistOrNull())
524         worklist->completeAllForVM(*this);
525 #endif // ENABLE(JIT)
526
527 #if ENABLE(DFG_JIT)
528     // Make sure concurrent compilations are done, but don't install them, since there is
529     // no point to doing so.
530     for (unsigned i = DFG::numberOfWorklists(); i--;) {
531         if (DFG::Worklist* worklist = DFG::existingWorklistForIndexOrNull(i)) {
532             worklist->removeNonCompilingPlansForVM(*this);
533             worklist->waitUntilAllPlansForVMAreReady(*this);
534             worklist->removeAllReadyPlansForVM(*this);
535         }
536     }
537 #endif // ENABLE(DFG_JIT)
538     
539     waitForAsynchronousDisassembly();
540     
541     // Clear this first to ensure that nobody tries to remove themselves from it.
542     m_perBytecodeProfiler = nullptr;
543
544     ASSERT(currentThreadIsHoldingAPILock());
545     m_apiLock->willDestroyVM(this);
546     smallStrings.setIsInitialized(false);
547     heap.lastChanceToFinalize();
548
549     JSRunLoopTimer::Manager::shared().unregisterVM(*this);
550     
551     delete interpreter;
552 #ifndef NDEBUG
553     interpreter = reinterpret_cast<Interpreter*>(0xbbadbeef);
554 #endif
555
556     delete emptyList;
557
558     delete propertyNames;
559     if (vmType != Default)
560         delete m_atomicStringTable;
561
562     delete clientData;
563     delete m_regExpCache;
564
565 #if ENABLE(REGEXP_TRACING)
566     delete m_rtTraceList;
567 #endif
568
569 #if ENABLE(DFG_JIT)
570     for (unsigned i = 0; i < m_scratchBuffers.size(); ++i)
571         fastFree(m_scratchBuffers[i]);
572 #endif
573 }
574
575 void VM::primitiveGigacageDisabledCallback(void* argument)
576 {
577     static_cast<VM*>(argument)->primitiveGigacageDisabled();
578 }
579
580 void VM::primitiveGigacageDisabled()
581 {
582     if (m_apiLock->currentThreadIsHoldingLock()) {
583         m_primitiveGigacageEnabled.fireAll(*this, "Primitive gigacage disabled");
584         return;
585     }
586  
587     // This is totally racy, and that's OK. The point is, it's up to the user to ensure that they pass the
588     // uncaged buffer in a nicely synchronized manner.
589     m_needToFirePrimitiveGigacageEnabled = true;
590 }
591
592 void VM::setLastStackTop(void* lastStackTop)
593
594     m_lastStackTop = lastStackTop;
595 }
596
597 Ref<VM> VM::createContextGroup(HeapType heapType)
598 {
599     return adoptRef(*new VM(APIContextGroup, heapType));
600 }
601
602 Ref<VM> VM::create(HeapType heapType)
603 {
604     return adoptRef(*new VM(Default, heapType));
605 }
606
607 bool VM::sharedInstanceExists()
608 {
609     return sharedInstanceInternal();
610 }
611
612 VM& VM::sharedInstance()
613 {
614     GlobalJSLock globalLock;
615     VM*& instance = sharedInstanceInternal();
616     if (!instance)
617         instance = adoptRef(new VM(APIShared, SmallHeap)).leakRef();
618     return *instance;
619 }
620
621 VM*& VM::sharedInstanceInternal()
622 {
623     static VM* sharedInstance;
624     return sharedInstance;
625 }
626
627 Watchdog& VM::ensureWatchdog()
628 {
629     if (!m_watchdog)
630         m_watchdog = adoptRef(new Watchdog(this));
631     return *m_watchdog;
632 }
633
634 HeapProfiler& VM::ensureHeapProfiler()
635 {
636     if (!m_heapProfiler)
637         m_heapProfiler = std::make_unique<HeapProfiler>(*this);
638     return *m_heapProfiler;
639 }
640
641 #if ENABLE(SAMPLING_PROFILER)
642 SamplingProfiler& VM::ensureSamplingProfiler(RefPtr<Stopwatch>&& stopwatch)
643 {
644     if (!m_samplingProfiler)
645         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
646     return *m_samplingProfiler;
647 }
648 #endif // ENABLE(SAMPLING_PROFILER)
649
650 #if ENABLE(JIT)
651 static ThunkGenerator thunkGeneratorForIntrinsic(Intrinsic intrinsic)
652 {
653     switch (intrinsic) {
654     case CharCodeAtIntrinsic:
655         return charCodeAtThunkGenerator;
656     case CharAtIntrinsic:
657         return charAtThunkGenerator;
658     case Clz32Intrinsic:
659         return clz32ThunkGenerator;
660     case FromCharCodeIntrinsic:
661         return fromCharCodeThunkGenerator;
662     case SqrtIntrinsic:
663         return sqrtThunkGenerator;
664     case AbsIntrinsic:
665         return absThunkGenerator;
666     case FloorIntrinsic:
667         return floorThunkGenerator;
668     case CeilIntrinsic:
669         return ceilThunkGenerator;
670     case TruncIntrinsic:
671         return truncThunkGenerator;
672     case RoundIntrinsic:
673         return roundThunkGenerator;
674     case ExpIntrinsic:
675         return expThunkGenerator;
676     case LogIntrinsic:
677         return logThunkGenerator;
678     case IMulIntrinsic:
679         return imulThunkGenerator;
680     case RandomIntrinsic:
681         return randomThunkGenerator;
682     case BoundThisNoArgsFunctionCallIntrinsic:
683         return boundThisNoArgsFunctionCallGenerator;
684     default:
685         return nullptr;
686     }
687 }
688
689 #endif // ENABLE(JIT)
690
691 NativeExecutable* VM::getHostFunction(NativeFunction function, NativeFunction constructor, const String& name)
692 {
693     return getHostFunction(function, NoIntrinsic, constructor, nullptr, name);
694 }
695
696 static Ref<NativeJITCode> jitCodeForCallTrampoline()
697 {
698     static NativeJITCode* result;
699     static std::once_flag onceKey;
700     std::call_once(onceKey, [&] {
701         result = new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_call_trampoline), JITCode::HostCallThunk, NoIntrinsic);
702     });
703     return makeRef(*result);
704 }
705
706 static Ref<NativeJITCode> jitCodeForConstructTrampoline()
707 {
708     static NativeJITCode* result;
709     static std::once_flag onceKey;
710     std::call_once(onceKey, [&] {
711         result = new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_construct_trampoline), JITCode::HostCallThunk, NoIntrinsic);
712     });
713     return makeRef(*result);
714 }
715
716 NativeExecutable* VM::getHostFunction(NativeFunction function, Intrinsic intrinsic, NativeFunction constructor, const DOMJIT::Signature* signature, const String& name)
717 {
718 #if ENABLE(JIT)
719     if (canUseJIT()) {
720         return jitStubs->hostFunctionStub(
721             this, function, constructor,
722             intrinsic != NoIntrinsic ? thunkGeneratorForIntrinsic(intrinsic) : 0,
723             intrinsic, signature, name);
724     }
725 #endif // ENABLE(JIT)
726     UNUSED_PARAM(intrinsic);
727     UNUSED_PARAM(signature);
728     return NativeExecutable::create(*this, jitCodeForCallTrampoline(), function, jitCodeForConstructTrampoline(), constructor, name);
729 }
730
731 MacroAssemblerCodePtr<JSEntryPtrTag> VM::getCTIInternalFunctionTrampolineFor(CodeSpecializationKind kind)
732 {
733 #if ENABLE(JIT)
734     if (canUseJIT()) {
735         if (kind == CodeForCall)
736             return jitStubs->ctiInternalFunctionCall(this).retagged<JSEntryPtrTag>();
737         return jitStubs->ctiInternalFunctionConstruct(this).retagged<JSEntryPtrTag>();
738     }
739 #endif
740     if (kind == CodeForCall)
741         return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_call_trampoline);
742     return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_construct_trampoline);
743 }
744
745 VM::ClientData::~ClientData()
746 {
747 }
748
749 void VM::resetDateCache()
750 {
751     localTimeOffsetCache.reset();
752     cachedDateString = String();
753     cachedDateStringValue = std::numeric_limits<double>::quiet_NaN();
754     dateInstanceCache.reset();
755 }
756
757 void VM::whenIdle(Function<void()>&& callback)
758 {
759     if (!entryScope) {
760         callback();
761         return;
762     }
763
764     entryScope->addDidPopListener(WTFMove(callback));
765 }
766
767 void VM::deleteAllLinkedCode(DeleteAllCodeEffort effort)
768 {
769     whenIdle([=] () {
770         heap.deleteAllCodeBlocks(effort);
771     });
772 }
773
774 void VM::deleteAllCode(DeleteAllCodeEffort effort)
775 {
776     whenIdle([=] () {
777         m_codeCache->clear();
778         m_regExpCache->deleteAllCode();
779         heap.deleteAllCodeBlocks(effort);
780         heap.deleteAllUnlinkedCodeBlocks(effort);
781         heap.reportAbandonedObjectGraph();
782     });
783 }
784
785 void VM::shrinkFootprintWhenIdle()
786 {
787     whenIdle([=] () {
788         sanitizeStackForVM(this);
789         deleteAllCode(DeleteAllCodeIfNotCollecting);
790         heap.collectNow(Synchronousness::Sync, CollectionScope::Full);
791         // FIXME: Consider stopping various automatic threads here.
792         // https://bugs.webkit.org/show_bug.cgi?id=185447
793         WTF::releaseFastMallocFreeMemory();
794     });
795 }
796
797 SourceProviderCache* VM::addSourceProviderCache(SourceProvider* sourceProvider)
798 {
799     auto addResult = sourceProviderCacheMap.add(sourceProvider, nullptr);
800     if (addResult.isNewEntry)
801         addResult.iterator->value = adoptRef(new SourceProviderCache);
802     return addResult.iterator->value.get();
803 }
804
805 void VM::clearSourceProviderCaches()
806 {
807     sourceProviderCacheMap.clear();
808 }
809
810 void VM::throwException(ExecState* exec, Exception* exception)
811 {
812     ASSERT(exec == topCallFrame || exec->isGlobalExec() || exec == exec->lexicalGlobalObject()->callFrameAtDebuggerEntry());
813     CallFrame* throwOriginFrame = exec->isGlobalExec() ? exec : topJSCallFrame();
814
815     if (Options::breakOnThrow()) {
816         CodeBlock* codeBlock = throwOriginFrame ? throwOriginFrame->codeBlock() : nullptr;
817         dataLog("Throwing exception in call frame ", RawPointer(throwOriginFrame), " for code block ", codeBlock, "\n");
818         CRASH();
819     }
820
821     interpreter->notifyDebuggerOfExceptionToBeThrown(*this, throwOriginFrame, exception);
822
823     setException(exception);
824
825 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
826     m_nativeStackTraceOfLastThrow = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
827     m_throwingThread = &Thread::current();
828 #endif
829 }
830
831 JSValue VM::throwException(ExecState* exec, JSValue thrownValue)
832 {
833     VM& vm = *this;
834     Exception* exception = jsDynamicCast<Exception*>(vm, thrownValue);
835     if (!exception)
836         exception = Exception::create(*this, thrownValue);
837
838     throwException(exec, exception);
839     return JSValue(exception);
840 }
841
842 JSObject* VM::throwException(ExecState* exec, JSObject* error)
843 {
844     return asObject(throwException(exec, JSValue(error)));
845 }
846
847 void VM::setStackPointerAtVMEntry(void* sp)
848 {
849     m_stackPointerAtVMEntry = sp;
850     updateStackLimits();
851 }
852
853 size_t VM::updateSoftReservedZoneSize(size_t softReservedZoneSize)
854 {
855     size_t oldSoftReservedZoneSize = m_currentSoftReservedZoneSize;
856     m_currentSoftReservedZoneSize = softReservedZoneSize;
857 #if ENABLE(C_LOOP)
858     interpreter->cloopStack().setSoftReservedZoneSize(softReservedZoneSize);
859 #endif
860
861     updateStackLimits();
862
863     return oldSoftReservedZoneSize;
864 }
865
866 #if OS(WINDOWS)
867 // On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
868 // where the guard page is a barrier between committed and uncommitted memory.
869 // When data from the guard page is read or written, the guard page is moved, and memory is committed.
870 // This is how the system grows the stack.
871 // When using the C stack on Windows we need to precommit the needed stack space.
872 // Otherwise we might crash later if we access uncommitted stack memory.
873 // This can happen if we allocate stack space larger than the page guard size (4K).
874 // The system does not get the chance to move the guard page, and commit more memory,
875 // and we crash if uncommitted memory is accessed.
876 // The MSVC compiler fixes this by inserting a call to the _chkstk() function,
877 // when needed, see http://support.microsoft.com/kb/100775.
878 // By touching every page up to the stack limit with a dummy operation,
879 // we force the system to move the guard page, and commit memory.
880
881 static void preCommitStackMemory(void* stackLimit)
882 {
883     const int pageSize = 4096;
884     for (volatile char* p = reinterpret_cast<char*>(&stackLimit); p > stackLimit; p -= pageSize) {
885         char ch = *p;
886         *p = ch;
887     }
888 }
889 #endif
890
891 inline void VM::updateStackLimits()
892 {
893 #if OS(WINDOWS)
894     void* lastSoftStackLimit = m_softStackLimit;
895 #endif
896
897     const StackBounds& stack = Thread::current().stack();
898     size_t reservedZoneSize = Options::reservedZoneSize();
899     // We should have already ensured that Options::reservedZoneSize() >= minimumReserveZoneSize at
900     // options initialization time, and the option value should not have been changed thereafter.
901     // We don't have the ability to assert here that it hasn't changed, but we can at least assert
902     // that the value is sane.
903     RELEASE_ASSERT(reservedZoneSize >= minimumReservedZoneSize);
904
905     if (m_stackPointerAtVMEntry) {
906         ASSERT(stack.isGrowingDownward());
907         char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
908         m_softStackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), m_currentSoftReservedZoneSize);
909         m_stackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), reservedZoneSize);
910     } else {
911         m_softStackLimit = stack.recursionLimit(m_currentSoftReservedZoneSize);
912         m_stackLimit = stack.recursionLimit(reservedZoneSize);
913     }
914
915 #if OS(WINDOWS)
916     // We only need to precommit stack memory dictated by the VM::m_softStackLimit limit.
917     // This is because VM::m_softStackLimit applies to stack usage by LLINT asm or JIT
918     // generated code which can allocate stack space that the C++ compiler does not know
919     // about. As such, we have to precommit that stack memory manually.
920     //
921     // In contrast, we do not need to worry about VM::m_stackLimit because that limit is
922     // used exclusively by C++ code, and the C++ compiler will automatically commit the
923     // needed stack pages.
924     if (lastSoftStackLimit != m_softStackLimit)
925         preCommitStackMemory(m_softStackLimit);
926 #endif
927 }
928
929 #if ENABLE(DFG_JIT)
930 void VM::gatherScratchBufferRoots(ConservativeRoots& conservativeRoots)
931 {
932     auto lock = holdLock(m_scratchBufferLock);
933     for (auto* scratchBuffer : m_scratchBuffers) {
934         if (scratchBuffer->activeLength()) {
935             void* bufferStart = scratchBuffer->dataBuffer();
936             conservativeRoots.add(bufferStart, static_cast<void*>(static_cast<char*>(bufferStart) + scratchBuffer->activeLength()));
937         }
938     }
939 }
940 #endif
941
942 void logSanitizeStack(VM* vm)
943 {
944     if (Options::verboseSanitizeStack() && vm->topCallFrame) {
945         int dummy;
946         auto& stackBounds = Thread::current().stack();
947         dataLog(
948             "Sanitizing stack for VM = ", RawPointer(vm), " with top call frame at ", RawPointer(vm->topCallFrame),
949             ", current stack pointer at ", RawPointer(&dummy), ", in ",
950             pointerDump(vm->topCallFrame->codeBlock()), ", last code origin = ",
951             vm->topCallFrame->codeOrigin(), ", last stack top = ", RawPointer(vm->lastStackTop()), ", in stack range [", RawPointer(stackBounds.origin()), ", ", RawPointer(stackBounds.end()), "]\n");
952     }
953 }
954
955 #if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
956 char* VM::acquireRegExpPatternContexBuffer()
957 {
958     m_regExpPatternContextLock.lock();
959     ASSERT(m_regExpPatternContextLock.isLocked());
960     if (!m_regExpPatternContexBuffer)
961         m_regExpPatternContexBuffer = makeUniqueArray<char>(VM::patternContextBufferSize);
962     return m_regExpPatternContexBuffer.get();
963 }
964
965 void VM::releaseRegExpPatternContexBuffer()
966 {
967     ASSERT(m_regExpPatternContextLock.isLocked());
968
969     m_regExpPatternContextLock.unlock();
970 }
971 #endif
972
973 #if ENABLE(REGEXP_TRACING)
974 void VM::addRegExpToTrace(RegExp* regExp)
975 {
976     gcProtect(regExp);
977     m_rtTraceList->add(regExp);
978 }
979
980 void VM::dumpRegExpTrace()
981 {
982     // The first RegExp object is ignored.  It is create by the RegExpPrototype ctor and not used.
983     RTTraceList::iterator iter = ++m_rtTraceList->begin();
984     
985     if (iter != m_rtTraceList->end()) {
986         dataLogF("\nRegExp Tracing\n");
987         dataLogF("Regular Expression                              8 Bit          16 Bit        match()    Matches    Average\n");
988         dataLogF(" <Match only / Match>                         JIT Addr      JIT Address       calls      found   String len\n");
989         dataLogF("----------------------------------------+----------------+----------------+----------+----------+-----------\n");
990     
991         unsigned reCount = 0;
992     
993         for (; iter != m_rtTraceList->end(); ++iter, ++reCount) {
994             (*iter)->printTraceData();
995             gcUnprotect(*iter);
996         }
997
998         dataLogF("%d Regular Expressions\n", reCount);
999     }
1000     
1001     m_rtTraceList->clear();
1002 }
1003 #else
1004 void VM::dumpRegExpTrace()
1005 {
1006 }
1007 #endif
1008
1009 WatchpointSet* VM::ensureWatchpointSetForImpureProperty(const Identifier& propertyName)
1010 {
1011     auto result = m_impurePropertyWatchpointSets.add(propertyName.string(), nullptr);
1012     if (result.isNewEntry)
1013         result.iterator->value = adoptRef(new WatchpointSet(IsWatched));
1014     return result.iterator->value.get();
1015 }
1016
1017 void VM::registerWatchpointForImpureProperty(const Identifier& propertyName, Watchpoint* watchpoint)
1018 {
1019     ensureWatchpointSetForImpureProperty(propertyName)->add(watchpoint);
1020 }
1021
1022 void VM::addImpureProperty(const String& propertyName)
1023 {
1024     if (RefPtr<WatchpointSet> watchpointSet = m_impurePropertyWatchpointSets.take(propertyName))
1025         watchpointSet->fireAll(*this, "Impure property added");
1026 }
1027
1028 template<typename Func>
1029 static bool enableProfilerWithRespectToCount(unsigned& counter, const Func& doEnableWork)
1030 {
1031     bool needsToRecompile = false;
1032     if (!counter) {
1033         doEnableWork();
1034         needsToRecompile = true;
1035     }
1036     counter++;
1037
1038     return needsToRecompile;
1039 }
1040
1041 template<typename Func>
1042 static bool disableProfilerWithRespectToCount(unsigned& counter, const Func& doDisableWork)
1043 {
1044     RELEASE_ASSERT(counter > 0);
1045     bool needsToRecompile = false;
1046     counter--;
1047     if (!counter) {
1048         doDisableWork();
1049         needsToRecompile = true;
1050     }
1051
1052     return needsToRecompile;
1053 }
1054
1055 bool VM::enableTypeProfiler()
1056 {
1057     auto enableTypeProfiler = [this] () {
1058         this->m_typeProfiler = std::make_unique<TypeProfiler>();
1059         this->m_typeProfilerLog = std::make_unique<TypeProfilerLog>(*this);
1060     };
1061
1062     return enableProfilerWithRespectToCount(m_typeProfilerEnabledCount, enableTypeProfiler);
1063 }
1064
1065 bool VM::disableTypeProfiler()
1066 {
1067     auto disableTypeProfiler = [this] () {
1068         this->m_typeProfiler.reset(nullptr);
1069         this->m_typeProfilerLog.reset(nullptr);
1070     };
1071
1072     return disableProfilerWithRespectToCount(m_typeProfilerEnabledCount, disableTypeProfiler);
1073 }
1074
1075 bool VM::enableControlFlowProfiler()
1076 {
1077     auto enableControlFlowProfiler = [this] () {
1078         this->m_controlFlowProfiler = std::make_unique<ControlFlowProfiler>();
1079     };
1080
1081     return enableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, enableControlFlowProfiler);
1082 }
1083
1084 bool VM::disableControlFlowProfiler()
1085 {
1086     auto disableControlFlowProfiler = [this] () {
1087         this->m_controlFlowProfiler.reset(nullptr);
1088     };
1089
1090     return disableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, disableControlFlowProfiler);
1091 }
1092
1093 void VM::dumpTypeProfilerData()
1094 {
1095     if (!typeProfiler())
1096         return;
1097
1098     typeProfilerLog()->processLogEntries(*this, "VM Dump Types"_s);
1099     typeProfiler()->dumpTypeProfilerData(*this);
1100 }
1101
1102 void VM::queueMicrotask(JSGlobalObject& globalObject, Ref<Microtask>&& task)
1103 {
1104     m_microtaskQueue.append(std::make_unique<QueuedTask>(*this, &globalObject, WTFMove(task)));
1105 }
1106
1107 void VM::drainMicrotasks()
1108 {
1109     while (!m_microtaskQueue.isEmpty()) {
1110         m_microtaskQueue.takeFirst()->run();
1111         if (m_onEachMicrotaskTick)
1112             m_onEachMicrotaskTick(*this);
1113     }
1114 }
1115
1116 void QueuedTask::run()
1117 {
1118     m_microtask->run(m_globalObject->globalExec());
1119 }
1120
1121 void sanitizeStackForVM(VM* vm)
1122 {
1123     logSanitizeStack(vm);
1124     if (vm->topCallFrame) {
1125         auto& stackBounds = Thread::current().stack();
1126         ASSERT(vm->currentThreadIsHoldingAPILock());
1127         ASSERT_UNUSED(stackBounds, stackBounds.contains(vm->lastStackTop()));
1128     }
1129 #if ENABLE(C_LOOP)
1130     vm->interpreter->cloopStack().sanitizeStack();
1131 #else
1132     sanitizeStackForVMImpl(vm);
1133 #endif
1134 }
1135
1136 size_t VM::committedStackByteCount()
1137 {
1138 #if !ENABLE(C_LOOP)
1139     // When using the C stack, we don't know how many stack pages are actually
1140     // committed. So, we use the current stack usage as an estimate.
1141     ASSERT(Thread::current().stack().isGrowingDownward());
1142     uint8_t* current = bitwise_cast<uint8_t*>(currentStackPointer());
1143     uint8_t* high = bitwise_cast<uint8_t*>(Thread::current().stack().origin());
1144     return high - current;
1145 #else
1146     return CLoopStack::committedByteCount();
1147 #endif
1148 }
1149
1150 #if ENABLE(C_LOOP)
1151 bool VM::ensureStackCapacityForCLoop(Register* newTopOfStack)
1152 {
1153     return interpreter->cloopStack().ensureCapacityFor(newTopOfStack);
1154 }
1155
1156 bool VM::isSafeToRecurseSoftCLoop() const
1157 {
1158     return interpreter->cloopStack().isSafeToRecurse();
1159 }
1160 #endif // ENABLE(C_LOOP)
1161
1162 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
1163 void VM::verifyExceptionCheckNeedIsSatisfied(unsigned recursionDepth, ExceptionEventLocation& location)
1164 {
1165     if (!Options::validateExceptionChecks())
1166         return;
1167
1168     if (UNLIKELY(m_needExceptionCheck)) {
1169         auto throwDepth = m_simulatedThrowPointRecursionDepth;
1170         auto& throwLocation = m_simulatedThrowPointLocation;
1171
1172         dataLog(
1173             "ERROR: Unchecked JS exception:\n"
1174             "    This scope can throw a JS exception: ", throwLocation, "\n"
1175             "        (ExceptionScope::m_recursionDepth was ", throwDepth, ")\n"
1176             "    But the exception was unchecked as of this scope: ", location, "\n"
1177             "        (ExceptionScope::m_recursionDepth was ", recursionDepth, ")\n"
1178             "\n");
1179
1180         StringPrintStream out;
1181         std::unique_ptr<StackTrace> currentTrace = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
1182
1183         if (Options::dumpSimulatedThrows()) {
1184             out.println("The simulated exception was thrown at:");
1185             m_nativeStackTraceOfLastSimulatedThrow->dump(out, "    ");
1186             out.println();
1187         }
1188         out.println("Unchecked exception detected at:");
1189         currentTrace->dump(out, "    ");
1190         out.println();
1191
1192         dataLog(out.toCString());
1193         RELEASE_ASSERT(!m_needExceptionCheck);
1194     }
1195 }
1196 #endif
1197
1198 #if USE(CF)
1199 void VM::setRunLoop(CFRunLoopRef runLoop)
1200 {
1201     ASSERT(runLoop);
1202     m_runLoop = runLoop;
1203     JSRunLoopTimer::Manager::shared().didChangeRunLoop(*this, runLoop);
1204 }
1205 #endif // USE(CF)
1206
1207 ScratchBuffer* VM::scratchBufferForSize(size_t size)
1208 {
1209     if (!size)
1210         return nullptr;
1211
1212     auto locker = holdLock(m_scratchBufferLock);
1213
1214     if (size > m_sizeOfLastScratchBuffer) {
1215         // Protect against a N^2 memory usage pathology by ensuring
1216         // that at worst, we get a geometric series, meaning that the
1217         // total memory usage is somewhere around
1218         // max(scratch buffer size) * 4.
1219         m_sizeOfLastScratchBuffer = size * 2;
1220
1221         ScratchBuffer* newBuffer = ScratchBuffer::create(m_sizeOfLastScratchBuffer);
1222         RELEASE_ASSERT(newBuffer);
1223         m_scratchBuffers.append(newBuffer);
1224     }
1225
1226     ScratchBuffer* result = m_scratchBuffers.last();
1227     return result;
1228 }
1229
1230 void VM::clearScratchBuffers()
1231 {
1232     auto lock = holdLock(m_scratchBufferLock);
1233     for (auto* scratchBuffer : m_scratchBuffers)
1234         scratchBuffer->setActiveLength(0);
1235 }
1236
1237 void VM::ensureShadowChicken()
1238 {
1239     if (m_shadowChicken)
1240         return;
1241     m_shadowChicken = std::make_unique<ShadowChicken>();
1242 }
1243
1244 #define DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(name, heapCellType, type) \
1245     IsoSubspace* VM::name##Slow() \
1246     { \
1247         ASSERT(!m_##name); \
1248         auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, heapCellType, type); \
1249         WTF::storeStoreFence(); \
1250         m_##name = WTFMove(space); \
1251         return m_##name.get(); \
1252     }
1253
1254
1255 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, cellHeapCellType.get(), JSBoundFunction)
1256 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, destructibleObjectHeapCellType.get(), JSCallbackFunction)
1257 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterSetterFunctionSpace, cellHeapCellType.get(), JSCustomGetterSetterFunction)
1258 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, destructibleObjectHeapCellType.get(), ErrorInstance)
1259 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, cellHeapCellType.get(), JSNativeStdFunction)
1260 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, destructibleObjectHeapCellType.get(), ProxyRevoke)
1261 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, destructibleObjectHeapCellType.get(), JSWeakMap)
1262 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, destructibleObjectHeapCellType.get(), JSWeakSet)
1263 #if JSC_OBJC_API_ENABLED
1264 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, destructibleObjectHeapCellType.get(), ObjCCallbackFunction)
1265 #endif
1266 #if ENABLE(WEBASSEMBLY)
1267 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock)
1268 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, cellHeapCellType.get(), WebAssemblyFunction)
1269 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyWrapperFunctionSpace, cellHeapCellType.get(), WebAssemblyWrapperFunction)
1270 #endif
1271
1272 #undef DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW
1273
1274 #define DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(name, heapCellType, type) \
1275     IsoSubspace* VM::name##Slow() \
1276     { \
1277         ASSERT(!m_##name); \
1278         auto space = std::make_unique<SpaceAndSet> ISO_SUBSPACE_INIT(heap, heapCellType, type); \
1279         WTF::storeStoreFence(); \
1280         m_##name = WTFMove(space); \
1281         return &m_##name->space; \
1282     }
1283
1284 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(inferredValueSpace, destructibleCellHeapCellType.get(), InferredValue)
1285 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(evalExecutableSpace, destructibleCellHeapCellType.get(), EvalExecutable)
1286 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(moduleProgramExecutableSpace, destructibleCellHeapCellType.get(), ModuleProgramExecutable)
1287
1288 #undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW
1289
1290
1291 JSCell* VM::sentinelSetBucketSlow()
1292 {
1293     ASSERT(!m_sentinelSetBucket);
1294     auto* sentinel = JSSet::BucketType::createSentinel(*this);
1295     m_sentinelSetBucket.set(*this, sentinel);
1296     return sentinel;
1297 }
1298
1299 JSCell* VM::sentinelMapBucketSlow()
1300 {
1301     ASSERT(!m_sentinelMapBucket);
1302     auto* sentinel = JSMap::BucketType::createSentinel(*this);
1303     m_sentinelMapBucket.set(*this, sentinel);
1304     return sentinel;
1305 }
1306
1307 JSGlobalObject* VM::vmEntryGlobalObject(const CallFrame* callFrame) const
1308 {
1309     if (callFrame && callFrame->isGlobalExec()) {
1310         ASSERT(callFrame->callee().isCell() && callFrame->callee().asCell()->isObject());
1311         ASSERT(callFrame == callFrame->lexicalGlobalObject()->globalExec());
1312         return callFrame->lexicalGlobalObject();
1313     }
1314     ASSERT(entryScope);
1315     return entryScope->globalObject();
1316 }
1317
1318 } // namespace JSC