Unreviewed, rolling out r235107.
[WebKit-https.git] / Source / JavaScriptCore / runtime / VM.cpp
1 /*
2  * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer. 
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution. 
13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission. 
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28
29 #include "config.h"
30 #include "VM.h"
31
32 #include "ArgList.h"
33 #include "ArrayBufferNeuteringWatchpoint.h"
34 #include "BuiltinExecutables.h"
35 #include "BytecodeIntrinsicRegistry.h"
36 #include "CodeBlock.h"
37 #include "CodeCache.h"
38 #include "CommonIdentifiers.h"
39 #include "CommonSlowPaths.h"
40 #include "CustomGetterSetter.h"
41 #include "DFGWorklist.h"
42 #include "DirectEvalExecutable.h"
43 #include "Disassembler.h"
44 #include "Error.h"
45 #include "ErrorConstructor.h"
46 #include "ErrorInstance.h"
47 #include "EvalCodeBlock.h"
48 #include "Exception.h"
49 #include "ExecutableToCodeBlockEdge.h"
50 #include "FTLThunks.h"
51 #include "FastMallocAlignedMemoryAllocator.h"
52 #include "FunctionCodeBlock.h"
53 #include "FunctionConstructor.h"
54 #include "FunctionExecutable.h"
55 #include "GCActivityCallback.h"
56 #include "GetterSetter.h"
57 #include "GigacageAlignedMemoryAllocator.h"
58 #include "HasOwnPropertyCache.h"
59 #include "Heap.h"
60 #include "HeapIterationScope.h"
61 #include "HeapProfiler.h"
62 #include "HostCallReturnValue.h"
63 #include "Identifier.h"
64 #include "IncrementalSweeper.h"
65 #include "IndirectEvalExecutable.h"
66 #include "InferredTypeTable.h"
67 #include "InferredValue.h"
68 #include "Interpreter.h"
69 #include "IntlCollatorConstructor.h"
70 #include "IntlDateTimeFormatConstructor.h"
71 #include "IntlNumberFormatConstructor.h"
72 #include "IntlPluralRulesConstructor.h"
73 #include "JITCode.h"
74 #include "JITWorklist.h"
75 #include "JSAPIValueWrapper.h"
76 #include "JSArray.h"
77 #include "JSArrayBufferConstructor.h"
78 #include "JSAsyncFunction.h"
79 #include "JSBigInt.h"
80 #include "JSBoundFunction.h"
81 #include "JSCInlines.h"
82 #include "JSCallbackFunction.h"
83 #include "JSCustomGetterSetterFunction.h"
84 #include "JSDestructibleObjectHeapCellType.h"
85 #include "JSFixedArray.h"
86 #include "JSFunction.h"
87 #include "JSGlobalObjectFunctions.h"
88 #include "JSImmutableButterfly.h"
89 #include "JSInternalPromiseDeferred.h"
90 #include "JSLock.h"
91 #include "JSMap.h"
92 #include "JSMapIterator.h"
93 #include "JSPromiseDeferred.h"
94 #include "JSPropertyNameEnumerator.h"
95 #include "JSSegmentedVariableObjectHeapCellType.h"
96 #include "JSScriptFetchParameters.h"
97 #include "JSScriptFetcher.h"
98 #include "JSSet.h"
99 #include "JSSetIterator.h"
100 #include "JSSourceCode.h"
101 #include "JSStringHeapCellType.h"
102 #include "JSTemplateObjectDescriptor.h"
103 #include "JSWeakMap.h"
104 #include "JSWeakSet.h"
105 #include "JSWebAssembly.h"
106 #include "JSWebAssemblyCodeBlock.h"
107 #include "JSWebAssemblyCodeBlockHeapCellType.h"
108 #include "JSWithScope.h"
109 #include "LLIntData.h"
110 #include "Lexer.h"
111 #include "Lookup.h"
112 #include "MinimumReservedZoneSize.h"
113 #include "ModuleProgramCodeBlock.h"
114 #include "ModuleProgramExecutable.h"
115 #include "NativeErrorConstructor.h"
116 #include "NativeExecutable.h"
117 #include "NativeStdFunctionCell.h"
118 #include "Nodes.h"
119 #include "ObjCCallbackFunction.h"
120 #include "Parser.h"
121 #include "ProfilerDatabase.h"
122 #include "ProgramCodeBlock.h"
123 #include "ProgramExecutable.h"
124 #include "PromiseDeferredTimer.h"
125 #include "PropertyMapHashTable.h"
126 #include "ProxyRevoke.h"
127 #include "RegExpCache.h"
128 #include "RegExpConstructor.h"
129 #include "RegExpObject.h"
130 #include "RegisterAtOffsetList.h"
131 #include "RuntimeType.h"
132 #include "SamplingProfiler.h"
133 #include "ShadowChicken.h"
134 #include "SimpleTypedArrayController.h"
135 #include "SourceProviderCache.h"
136 #include "StackVisitor.h"
137 #include "StrictEvalActivation.h"
138 #include "StrongInlines.h"
139 #include "StructureInlines.h"
140 #include "TestRunnerUtils.h"
141 #include "ThunkGenerators.h"
142 #include "TypeProfiler.h"
143 #include "TypeProfilerLog.h"
144 #include "UnlinkedCodeBlock.h"
145 #include "VMEntryScope.h"
146 #include "VMInspector.h"
147 #include "VariableEnvironment.h"
148 #include "WasmWorklist.h"
149 #include "Watchdog.h"
150 #include "WeakGCMapInlines.h"
151 #include "WebAssemblyFunction.h"
152 #include "WebAssemblyWrapperFunction.h"
153 #include <wtf/ProcessID.h>
154 #include <wtf/ReadWriteLock.h>
155 #include <wtf/SimpleStats.h>
156 #include <wtf/StringPrintStream.h>
157 #include <wtf/Threading.h>
158 #include <wtf/text/AtomicStringTable.h>
159 #include <wtf/text/SymbolRegistry.h>
160
161 #if !ENABLE(JIT)
162 #include "CLoopStack.h"
163 #include "CLoopStackInlines.h"
164 #endif
165
166 #if ENABLE(DFG_JIT)
167 #include "ConservativeRoots.h"
168 #endif
169
170 #if ENABLE(REGEXP_TRACING)
171 #include "RegExp.h"
172 #endif
173
174 using namespace WTF;
175
176 namespace JSC {
177
178 #if ENABLE(JIT)
179 #if !ASSERT_DISABLED
180 bool VM::s_canUseJITIsSet = false;
181 #endif
182 bool VM::s_canUseJIT = false;
183 #endif
184
185 Atomic<unsigned> VM::s_numberOfIDs;
186
187 // Note: Platform.h will enforce that ENABLE(ASSEMBLER) is true if either
188 // ENABLE(JIT) or ENABLE(YARR_JIT) or both are enabled. The code below
189 // just checks for ENABLE(JIT) or ENABLE(YARR_JIT) with this premise in mind.
190
191 #if ENABLE(ASSEMBLER)
192 static bool enableAssembler(ExecutableAllocator& executableAllocator)
193 {
194     if (!Options::useJIT() && !Options::useRegExpJIT())
195         return false;
196
197     if (!executableAllocator.isValid()) {
198         if (Options::crashIfCantAllocateJITMemory())
199             CRASH();
200         return false;
201     }
202
203     char* canUseJITString = getenv("JavaScriptCoreUseJIT");
204     return !canUseJITString || atoi(canUseJITString);
205 }
206 #endif // ENABLE(!ASSEMBLER)
207
208 bool VM::canUseAssembler()
209 {
210 #if ENABLE(ASSEMBLER)
211     static std::once_flag onceKey;
212     static bool enabled = false;
213     std::call_once(onceKey, [] {
214         enabled = enableAssembler(ExecutableAllocator::singleton());
215     });
216     return enabled;
217 #else
218     return false; // interpreter only
219 #endif
220 }
221
222 void VM::computeCanUseJIT()
223 {
224 #if ENABLE(JIT)
225 #if !ASSERT_DISABLED
226     RELEASE_ASSERT(!s_canUseJITIsSet);
227     s_canUseJITIsSet = true;
228 #endif
229     s_canUseJIT = VM::canUseAssembler() && Options::useJIT();
230 #endif
231 }
232
233 bool VM::canUseRegExpJIT()
234 {
235 #if ENABLE(YARR_JIT)
236     static std::once_flag onceKey;
237     static bool enabled = false;
238     std::call_once(onceKey, [] {
239         enabled = VM::canUseAssembler() && Options::useRegExpJIT();
240     });
241     return enabled;
242 #else
243     return false; // interpreter only
244 #endif
245 }
246
247 bool VM::isInMiniMode()
248 {
249     return !canUseJIT() || Options::forceMiniVMMode();
250 }
251
252 inline unsigned VM::nextID()
253 {
254     for (;;) {
255         unsigned currentNumberOfIDs = s_numberOfIDs.load();
256         unsigned newID = currentNumberOfIDs + 1;
257         if (s_numberOfIDs.compareExchangeWeak(currentNumberOfIDs, newID))
258             return newID;
259     }
260 }
261
262
263 VM::VM(VMType vmType, HeapType heapType)
264     : m_id(nextID())
265     , m_apiLock(adoptRef(new JSLock(this)))
266 #if USE(CF)
267     , m_runLoop(CFRunLoopGetCurrent())
268 #endif // USE(CF)
269     , heap(this, heapType)
270     , fastMallocAllocator(std::make_unique<FastMallocAlignedMemoryAllocator>())
271     , primitiveGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::Primitive))
272     , jsValueGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::JSValue))
273     , auxiliaryHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::Auxiliary)))
274     , cellJSValueOOBHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
275     , immutableButterflyHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCellWithInteriorPointers)))
276     , cellDangerousBitsHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
277     , destructibleCellHeapCellType(std::make_unique<HeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)))
278     , stringHeapCellType(std::make_unique<JSStringHeapCellType>())
279     , destructibleObjectHeapCellType(std::make_unique<JSDestructibleObjectHeapCellType>())
280     , segmentedVariableObjectHeapCellType(std::make_unique<JSSegmentedVariableObjectHeapCellType>())
281 #if ENABLE(WEBASSEMBLY)
282     , webAssemblyCodeBlockHeapCellType(std::make_unique<JSWebAssemblyCodeBlockHeapCellType>())
283 #endif
284     , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get())
285     , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get())
286     , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get())
287     , cellJSValueOOBSpace("JSCell JSValueOOB", heap, cellJSValueOOBHeapCellType.get(), fastMallocAllocator.get())
288     , cellDangerousBitsSpace("JSCell DangerousBits", heap, cellDangerousBitsHeapCellType.get(), fastMallocAllocator.get())
289     , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellJSValueOOBHeapCellType.get(), jsValueGigacageAllocator.get())
290     , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get())
291     , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get())
292     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
293     , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
294     , segmentedVariableObjectSpace("JSSegmentedVariableObjectSpace", heap, segmentedVariableObjectHeapCellType.get(), fastMallocAllocator.get())
295     , arrayBufferConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSArrayBufferConstructor)
296     , asyncFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncFunction)
297     , asyncGeneratorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncGeneratorFunction)
298     , boundFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSBoundFunction)
299     , callbackFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSCallbackFunction)
300     , customGetterSetterFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSCustomGetterSetterFunction)
301     , errorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ErrorConstructor)
302     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellDangerousBitsHeapCellType.get(), ExecutableToCodeBlockEdge)
303     , functionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSFunction)
304     , generatorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSGeneratorFunction)
305     , inferredTypeSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredType)
306     , inferredValueSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredValue)
307     , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
308 #if ENABLE(INTL)
309     , intlCollatorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlCollatorConstructor)
310     , intlDateTimeFormatConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlDateTimeFormatConstructor)
311     , intlNumberFormatConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlNumberFormatConstructor)
312     , intlPluralRulesConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlPluralRulesConstructor)
313 #endif
314     , nativeErrorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), NativeErrorConstructor)
315     , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable)
316     , nativeStdFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSNativeStdFunction)
317 #if JSC_OBJC_API_ENABLED
318     , objCCallbackFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ObjCCallbackFunction)
319 #endif
320     , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable)
321     , proxyRevokeSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ProxyRevoke)
322     , regExpConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), RegExpConstructor)
323     , strictModeTypeErrorFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), StrictModeTypeErrorFunction)
324     , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData)
325     , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure)
326     , weakSetSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakSet)
327     , weakMapSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakMap)
328     , errorInstanceSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ErrorInstance)
329 #if ENABLE(WEBASSEMBLY)
330     , webAssemblyCodeBlockSpace ISO_SUBSPACE_INIT(heap, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock)
331     , webAssemblyFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyFunction)
332     , webAssemblyWrapperFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyWrapperFunction)
333 #endif
334     , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
335     , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
336     , inferredTypesWithFinalizers(inferredTypeSpace)
337     , inferredValuesWithFinalizers(inferredValueSpace)
338     , evalCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), EvalCodeBlock)
339     , functionCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionCodeBlock)
340     , moduleProgramCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramCodeBlock)
341     , programCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramCodeBlock)
342     , directEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), DirectEvalExecutable)
343     , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
344     , indirectEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), IndirectEvalExecutable)
345     , moduleProgramExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramExecutable)
346     , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable)
347     , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable)
348     , vmType(vmType)
349     , clientData(0)
350     , topEntryFrame(nullptr)
351     , topCallFrame(CallFrame::noCaller())
352     , promiseDeferredTimer(std::make_unique<PromiseDeferredTimer>(*this))
353     , m_atomicStringTable(vmType == Default ? Thread::current().atomicStringTable() : new AtomicStringTable)
354     , propertyNames(nullptr)
355     , emptyList(new ArgList)
356     , machineCodeBytesPerBytecodeWordForBaselineJIT(std::make_unique<SimpleStats>())
357     , customGetterSetterFunctionMap(*this)
358     , stringCache(*this)
359     , symbolImplToSymbolMap(*this)
360     , structureCache(*this)
361     , interpreter(0)
362     , entryScope(0)
363     , m_regExpCache(new RegExpCache(this))
364     , m_compactVariableMap(adoptRef(*(new CompactVariableMap)))
365 #if ENABLE(REGEXP_TRACING)
366     , m_rtTraceList(new RTTraceList())
367 #endif
368 #if ENABLE(GC_VALIDATION)
369     , m_initializingObjectClass(0)
370 #endif
371     , m_stackPointerAtVMEntry(0)
372     , m_codeCache(std::make_unique<CodeCache>())
373     , m_builtinExecutables(std::make_unique<BuiltinExecutables>(*this))
374     , m_typeProfilerEnabledCount(0)
375     , m_primitiveGigacageEnabled(IsWatched)
376     , m_controlFlowProfilerEnabledCount(0)
377     , m_shadowChicken(std::make_unique<ShadowChicken>())
378 {
379     interpreter = new Interpreter(*this);
380     StackBounds stack = Thread::current().stack();
381     updateSoftReservedZoneSize(Options::softReservedZoneSize());
382     setLastStackTop(stack.origin());
383
384     // Need to be careful to keep everything consistent here
385     JSLockHolder lock(this);
386     AtomicStringTable* existingEntryAtomicStringTable = Thread::current().setCurrentAtomicStringTable(m_atomicStringTable);
387     propertyNames = new CommonIdentifiers(this);
388     structureStructure.set(*this, Structure::createStructure(*this));
389     structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
390     terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
391     stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
392     propertyNameEnumeratorStructure.set(*this, JSPropertyNameEnumerator::createStructure(*this, 0, jsNull()));
393     customGetterSetterStructure.set(*this, CustomGetterSetter::createStructure(*this, 0, jsNull()));
394     domAttributeGetterSetterStructure.set(*this, DOMAttributeGetterSetter::createStructure(*this, 0, jsNull()));
395     scopedArgumentsTableStructure.set(*this, ScopedArgumentsTable::createStructure(*this, 0, jsNull()));
396     apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, 0, jsNull()));
397     nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, 0, jsNull()));
398     evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, 0, jsNull()));
399     programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, 0, jsNull()));
400     functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, 0, jsNull()));
401 #if ENABLE(WEBASSEMBLY)
402     webAssemblyCodeBlockStructure.set(*this, JSWebAssemblyCodeBlock::createStructure(*this, 0, jsNull()));
403 #endif
404     moduleProgramExecutableStructure.set(*this, ModuleProgramExecutable::createStructure(*this, 0, jsNull()));
405     regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
406     symbolStructure.set(*this, Symbol::createStructure(*this, 0, jsNull()));
407     symbolTableStructure.set(*this, SymbolTable::createStructure(*this, 0, jsNull()));
408     fixedArrayStructure.set(*this, JSFixedArray::createStructure(*this, 0, jsNull()));
409
410     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithInt32) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithInt32));
411     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithDouble) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithDouble));
412     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithContiguous) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithContiguous));
413
414     sourceCodeStructure.set(*this, JSSourceCode::createStructure(*this, 0, jsNull()));
415     scriptFetcherStructure.set(*this, JSScriptFetcher::createStructure(*this, 0, jsNull()));
416     scriptFetchParametersStructure.set(*this, JSScriptFetchParameters::createStructure(*this, 0, jsNull()));
417     structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
418     sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
419     templateObjectDescriptorStructure.set(*this, JSTemplateObjectDescriptor::createStructure(*this, 0, jsNull()));
420     arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpoint::createStructure(*this));
421     unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
422     unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
423     unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
424     unlinkedFunctionCodeBlockStructure.set(*this, UnlinkedFunctionCodeBlock::createStructure(*this, 0, jsNull()));
425     unlinkedModuleProgramCodeBlockStructure.set(*this, UnlinkedModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
426     propertyTableStructure.set(*this, PropertyTable::createStructure(*this, 0, jsNull()));
427     inferredTypeStructure.set(*this, InferredType::createStructure(*this, 0, jsNull()));
428     inferredTypeTableStructure.set(*this, InferredTypeTable::createStructure(*this, 0, jsNull()));
429     inferredValueStructure.set(*this, InferredValue::createStructure(*this, 0, jsNull()));
430     functionRareDataStructure.set(*this, FunctionRareData::createStructure(*this, 0, jsNull()));
431     exceptionStructure.set(*this, Exception::createStructure(*this, 0, jsNull()));
432     promiseDeferredStructure.set(*this, JSPromiseDeferred::createStructure(*this, 0, jsNull()));
433     internalPromiseDeferredStructure.set(*this, JSInternalPromiseDeferred::createStructure(*this, 0, jsNull()));
434     programCodeBlockStructure.set(*this, ProgramCodeBlock::createStructure(*this, 0, jsNull()));
435     moduleProgramCodeBlockStructure.set(*this, ModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
436     evalCodeBlockStructure.set(*this, EvalCodeBlock::createStructure(*this, 0, jsNull()));
437     functionCodeBlockStructure.set(*this, FunctionCodeBlock::createStructure(*this, 0, jsNull()));
438     hashMapBucketSetStructure.set(*this, HashMapBucket<HashMapBucketDataKey>::createStructure(*this, 0, jsNull()));
439     hashMapBucketMapStructure.set(*this, HashMapBucket<HashMapBucketDataKeyValue>::createStructure(*this, 0, jsNull()));
440     setIteratorStructure.set(*this, JSSetIterator::createStructure(*this, 0, jsNull()));
441     mapIteratorStructure.set(*this, JSMapIterator::createStructure(*this, 0, jsNull()));
442     bigIntStructure.set(*this, JSBigInt::createStructure(*this, 0, jsNull()));
443     executableToCodeBlockEdgeStructure.set(*this, ExecutableToCodeBlockEdge::createStructure(*this, nullptr, jsNull()));
444
445     sentinelSetBucket.set(*this, JSSet::BucketType::createSentinel(*this));
446     sentinelMapBucket.set(*this, JSMap::BucketType::createSentinel(*this));
447
448     nativeStdFunctionCellStructure.set(*this, NativeStdFunctionCell::createStructure(*this, 0, jsNull()));
449     smallStrings.initializeCommonStrings(*this);
450
451     Thread::current().setCurrentAtomicStringTable(existingEntryAtomicStringTable);
452
453 #if ENABLE(JIT)
454     jitStubs = std::make_unique<JITThunks>();
455 #endif
456
457 #if ENABLE(FTL_JIT)
458     ftlThunks = std::make_unique<FTL::Thunks>();
459 #endif // ENABLE(FTL_JIT)
460     
461 #if ENABLE(JIT)
462     initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
463 #endif
464     
465     Gigacage::addPrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
466
467     heap.notifyIsSafeToCollect();
468     
469     LLInt::Data::performAssertions(*this);
470     
471     if (UNLIKELY(Options::useProfiler())) {
472         m_perBytecodeProfiler = std::make_unique<Profiler::Database>(*this);
473
474         StringPrintStream pathOut;
475         const char* profilerPath = getenv("JSC_PROFILER_PATH");
476         if (profilerPath)
477             pathOut.print(profilerPath, "/");
478         pathOut.print("JSCProfile-", getCurrentProcessID(), "-", m_perBytecodeProfiler->databaseID(), ".json");
479         m_perBytecodeProfiler->registerToSaveAtExit(pathOut.toCString().data());
480     }
481
482     callFrameForCatch = nullptr;
483
484     // Initialize this last, as a free way of asserting that VM initialization itself
485     // won't use this.
486     m_typedArrayController = adoptRef(new SimpleTypedArrayController());
487
488     m_bytecodeIntrinsicRegistry = std::make_unique<BytecodeIntrinsicRegistry>(*this);
489
490     if (Options::useTypeProfiler())
491         enableTypeProfiler();
492     if (Options::useControlFlowProfiler())
493         enableControlFlowProfiler();
494 #if ENABLE(SAMPLING_PROFILER)
495     if (Options::useSamplingProfiler()) {
496         setShouldBuildPCToCodeOriginMapping();
497         Ref<Stopwatch> stopwatch = Stopwatch::create();
498         stopwatch->start();
499         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
500         if (Options::samplingProfilerPath())
501             m_samplingProfiler->registerForReportAtExit();
502         m_samplingProfiler->start();
503     }
504 #endif // ENABLE(SAMPLING_PROFILER)
505
506     if (Options::alwaysGeneratePCToCodeOriginMap())
507         setShouldBuildPCToCodeOriginMapping();
508
509     if (Options::watchdog()) {
510         Watchdog& watchdog = ensureWatchdog();
511         watchdog.setTimeLimit(Seconds::fromMilliseconds(Options::watchdog()));
512     }
513
514 #if ENABLE(JIT)
515     // Make sure that any stubs that the JIT is going to use are initialized in non-compilation threads.
516     if (canUseJIT()) {
517         getCTIInternalFunctionTrampolineFor(CodeForCall);
518         getCTIInternalFunctionTrampolineFor(CodeForConstruct);
519     }
520 #endif
521
522     if (!canUseJIT())
523         noJITValueProfileSingleton = std::make_unique<ValueProfile>(0);
524
525     VMInspector::instance().add(this);
526 }
527
528 static ReadWriteLock s_destructionLock;
529
530 void waitForVMDestruction()
531 {
532     auto locker = holdLock(s_destructionLock.write());
533 }
534
535 VM::~VM()
536 {
537     auto destructionLocker = holdLock(s_destructionLock.read());
538     
539     Gigacage::removePrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
540     promiseDeferredTimer->stopRunningTasks();
541 #if ENABLE(WEBASSEMBLY)
542     if (Wasm::existingWorklistOrNull())
543         Wasm::ensureWorklist().stopAllPlansForContext(wasmContext);
544 #endif
545     if (UNLIKELY(m_watchdog))
546         m_watchdog->willDestroyVM(this);
547     m_traps.willDestroyVM();
548     VMInspector::instance().remove(this);
549
550     // Never GC, ever again.
551     heap.incrementDeferralDepth();
552
553 #if ENABLE(SAMPLING_PROFILER)
554     if (m_samplingProfiler) {
555         m_samplingProfiler->reportDataToOptionFile();
556         m_samplingProfiler->shutdown();
557     }
558 #endif // ENABLE(SAMPLING_PROFILER)
559     
560 #if ENABLE(JIT)
561     JITWorklist::instance()->completeAllForVM(*this);
562 #endif // ENABLE(JIT)
563
564 #if ENABLE(DFG_JIT)
565     // Make sure concurrent compilations are done, but don't install them, since there is
566     // no point to doing so.
567     for (unsigned i = DFG::numberOfWorklists(); i--;) {
568         if (DFG::Worklist* worklist = DFG::existingWorklistForIndexOrNull(i)) {
569             worklist->removeNonCompilingPlansForVM(*this);
570             worklist->waitUntilAllPlansForVMAreReady(*this);
571             worklist->removeAllReadyPlansForVM(*this);
572         }
573     }
574 #endif // ENABLE(DFG_JIT)
575     
576     waitForAsynchronousDisassembly();
577     
578     // Clear this first to ensure that nobody tries to remove themselves from it.
579     m_perBytecodeProfiler = nullptr;
580
581     ASSERT(currentThreadIsHoldingAPILock());
582     m_apiLock->willDestroyVM(this);
583     heap.lastChanceToFinalize();
584     
585     delete interpreter;
586 #ifndef NDEBUG
587     interpreter = reinterpret_cast<Interpreter*>(0xbbadbeef);
588 #endif
589
590     delete emptyList;
591
592     delete propertyNames;
593     if (vmType != Default)
594         delete m_atomicStringTable;
595
596     delete clientData;
597     delete m_regExpCache;
598
599 #if ENABLE(REGEXP_TRACING)
600     delete m_rtTraceList;
601 #endif
602
603 #if ENABLE(DFG_JIT)
604     for (unsigned i = 0; i < m_scratchBuffers.size(); ++i)
605         fastFree(m_scratchBuffers[i]);
606 #endif
607 }
608
609 void VM::primitiveGigacageDisabledCallback(void* argument)
610 {
611     static_cast<VM*>(argument)->primitiveGigacageDisabled();
612 }
613
614 void VM::primitiveGigacageDisabled()
615 {
616     if (m_apiLock->currentThreadIsHoldingLock()) {
617         m_primitiveGigacageEnabled.fireAll(*this, "Primitive gigacage disabled");
618         return;
619     }
620  
621     // This is totally racy, and that's OK. The point is, it's up to the user to ensure that they pass the
622     // uncaged buffer in a nicely synchronized manner.
623     m_needToFirePrimitiveGigacageEnabled = true;
624 }
625
626 void VM::setLastStackTop(void* lastStackTop)
627
628     m_lastStackTop = lastStackTop;
629 }
630
631 Ref<VM> VM::createContextGroup(HeapType heapType)
632 {
633     return adoptRef(*new VM(APIContextGroup, heapType));
634 }
635
636 Ref<VM> VM::create(HeapType heapType)
637 {
638     return adoptRef(*new VM(Default, heapType));
639 }
640
641 bool VM::sharedInstanceExists()
642 {
643     return sharedInstanceInternal();
644 }
645
646 VM& VM::sharedInstance()
647 {
648     GlobalJSLock globalLock;
649     VM*& instance = sharedInstanceInternal();
650     if (!instance)
651         instance = adoptRef(new VM(APIShared, SmallHeap)).leakRef();
652     return *instance;
653 }
654
655 VM*& VM::sharedInstanceInternal()
656 {
657     static VM* sharedInstance;
658     return sharedInstance;
659 }
660
661 Watchdog& VM::ensureWatchdog()
662 {
663     if (!m_watchdog)
664         m_watchdog = adoptRef(new Watchdog(this));
665     return *m_watchdog;
666 }
667
668 HeapProfiler& VM::ensureHeapProfiler()
669 {
670     if (!m_heapProfiler)
671         m_heapProfiler = std::make_unique<HeapProfiler>(*this);
672     return *m_heapProfiler;
673 }
674
675 #if ENABLE(SAMPLING_PROFILER)
676 SamplingProfiler& VM::ensureSamplingProfiler(RefPtr<Stopwatch>&& stopwatch)
677 {
678     if (!m_samplingProfiler)
679         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
680     return *m_samplingProfiler;
681 }
682 #endif // ENABLE(SAMPLING_PROFILER)
683
684 #if ENABLE(JIT)
685 static ThunkGenerator thunkGeneratorForIntrinsic(Intrinsic intrinsic)
686 {
687     switch (intrinsic) {
688     case CharCodeAtIntrinsic:
689         return charCodeAtThunkGenerator;
690     case CharAtIntrinsic:
691         return charAtThunkGenerator;
692     case Clz32Intrinsic:
693         return clz32ThunkGenerator;
694     case FromCharCodeIntrinsic:
695         return fromCharCodeThunkGenerator;
696     case SqrtIntrinsic:
697         return sqrtThunkGenerator;
698     case AbsIntrinsic:
699         return absThunkGenerator;
700     case FloorIntrinsic:
701         return floorThunkGenerator;
702     case CeilIntrinsic:
703         return ceilThunkGenerator;
704     case TruncIntrinsic:
705         return truncThunkGenerator;
706     case RoundIntrinsic:
707         return roundThunkGenerator;
708     case ExpIntrinsic:
709         return expThunkGenerator;
710     case LogIntrinsic:
711         return logThunkGenerator;
712     case IMulIntrinsic:
713         return imulThunkGenerator;
714     case RandomIntrinsic:
715         return randomThunkGenerator;
716     case BoundThisNoArgsFunctionCallIntrinsic:
717         return boundThisNoArgsFunctionCallGenerator;
718     default:
719         return nullptr;
720     }
721 }
722
723 #endif // ENABLE(JIT)
724
725 NativeExecutable* VM::getHostFunction(NativeFunction function, NativeFunction constructor, const String& name)
726 {
727     return getHostFunction(function, NoIntrinsic, constructor, nullptr, name);
728 }
729
730 NativeExecutable* VM::getHostFunction(NativeFunction function, Intrinsic intrinsic, NativeFunction constructor, const DOMJIT::Signature* signature, const String& name)
731 {
732 #if ENABLE(JIT)
733     if (canUseJIT()) {
734         return jitStubs->hostFunctionStub(
735             this, function, constructor,
736             intrinsic != NoIntrinsic ? thunkGeneratorForIntrinsic(intrinsic) : 0,
737             intrinsic, signature, name);
738     }
739 #else // ENABLE(JIT)
740     UNUSED_PARAM(intrinsic);
741 #endif // ENABLE(JIT)
742     return NativeExecutable::create(*this,
743         adoptRef(*new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_call_trampoline), JITCode::HostCallThunk)), function,
744         adoptRef(*new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_construct_trampoline), JITCode::HostCallThunk)), constructor,
745         NoIntrinsic, signature, name);
746 }
747
748 MacroAssemblerCodePtr<JSEntryPtrTag> VM::getCTIInternalFunctionTrampolineFor(CodeSpecializationKind kind)
749 {
750 #if ENABLE(JIT)
751     if (canUseJIT()) {
752         if (kind == CodeForCall)
753             return jitStubs->ctiInternalFunctionCall(this).retagged<JSEntryPtrTag>();
754         return jitStubs->ctiInternalFunctionConstruct(this).retagged<JSEntryPtrTag>();
755     }
756 #endif
757     if (kind == CodeForCall)
758         return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_call_trampoline);
759     return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_construct_trampoline);
760 }
761
762 VM::ClientData::~ClientData()
763 {
764 }
765
766 void VM::resetDateCache()
767 {
768     localTimeOffsetCache.reset();
769     cachedDateString = String();
770     cachedDateStringValue = std::numeric_limits<double>::quiet_NaN();
771     dateInstanceCache.reset();
772 }
773
774 void VM::whenIdle(Function<void()>&& callback)
775 {
776     if (!entryScope) {
777         callback();
778         return;
779     }
780
781     entryScope->addDidPopListener(WTFMove(callback));
782 }
783
784 void VM::deleteAllLinkedCode(DeleteAllCodeEffort effort)
785 {
786     whenIdle([=] () {
787         heap.deleteAllCodeBlocks(effort);
788     });
789 }
790
791 void VM::deleteAllCode(DeleteAllCodeEffort effort)
792 {
793     whenIdle([=] () {
794         m_codeCache->clear();
795         m_regExpCache->deleteAllCode();
796         heap.deleteAllCodeBlocks(effort);
797         heap.deleteAllUnlinkedCodeBlocks(effort);
798         heap.reportAbandonedObjectGraph();
799     });
800 }
801
802 void VM::shrinkFootprintWhenIdle()
803 {
804     whenIdle([=] () {
805         sanitizeStackForVM(this);
806         deleteAllCode(DeleteAllCodeIfNotCollecting);
807         heap.collectNow(Synchronousness::Sync, CollectionScope::Full);
808         // FIXME: Consider stopping various automatic threads here.
809         // https://bugs.webkit.org/show_bug.cgi?id=185447
810         WTF::releaseFastMallocFreeMemory();
811     });
812 }
813
814 SourceProviderCache* VM::addSourceProviderCache(SourceProvider* sourceProvider)
815 {
816     auto addResult = sourceProviderCacheMap.add(sourceProvider, nullptr);
817     if (addResult.isNewEntry)
818         addResult.iterator->value = adoptRef(new SourceProviderCache);
819     return addResult.iterator->value.get();
820 }
821
822 void VM::clearSourceProviderCaches()
823 {
824     sourceProviderCacheMap.clear();
825 }
826
827 void VM::throwException(ExecState* exec, Exception* exception)
828 {
829     if (Options::breakOnThrow()) {
830         CodeBlock* codeBlock = exec->codeBlock();
831         dataLog("Throwing exception in call frame ", RawPointer(exec), " for code block ", codeBlock, "\n");
832         CRASH();
833     }
834
835     ASSERT(exec == topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec());
836
837     interpreter->notifyDebuggerOfExceptionToBeThrown(*this, exec, exception);
838
839     setException(exception);
840
841 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
842     m_nativeStackTraceOfLastThrow = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
843     m_throwingThread = &Thread::current();
844 #endif
845 }
846
847 JSValue VM::throwException(ExecState* exec, JSValue thrownValue)
848 {
849     VM& vm = *this;
850     Exception* exception = jsDynamicCast<Exception*>(vm, thrownValue);
851     if (!exception)
852         exception = Exception::create(*this, thrownValue);
853
854     throwException(exec, exception);
855     return JSValue(exception);
856 }
857
858 JSObject* VM::throwException(ExecState* exec, JSObject* error)
859 {
860     return asObject(throwException(exec, JSValue(error)));
861 }
862
863 void VM::setStackPointerAtVMEntry(void* sp)
864 {
865     m_stackPointerAtVMEntry = sp;
866     updateStackLimits();
867 }
868
869 size_t VM::updateSoftReservedZoneSize(size_t softReservedZoneSize)
870 {
871     size_t oldSoftReservedZoneSize = m_currentSoftReservedZoneSize;
872     m_currentSoftReservedZoneSize = softReservedZoneSize;
873 #if !ENABLE(JIT)
874     interpreter->cloopStack().setSoftReservedZoneSize(softReservedZoneSize);
875 #endif
876
877     updateStackLimits();
878
879     return oldSoftReservedZoneSize;
880 }
881
882 #if OS(WINDOWS)
883 // On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
884 // where the guard page is a barrier between committed and uncommitted memory.
885 // When data from the guard page is read or written, the guard page is moved, and memory is committed.
886 // This is how the system grows the stack.
887 // When using the C stack on Windows we need to precommit the needed stack space.
888 // Otherwise we might crash later if we access uncommitted stack memory.
889 // This can happen if we allocate stack space larger than the page guard size (4K).
890 // The system does not get the chance to move the guard page, and commit more memory,
891 // and we crash if uncommitted memory is accessed.
892 // The MSVC compiler fixes this by inserting a call to the _chkstk() function,
893 // when needed, see http://support.microsoft.com/kb/100775.
894 // By touching every page up to the stack limit with a dummy operation,
895 // we force the system to move the guard page, and commit memory.
896
897 static void preCommitStackMemory(void* stackLimit)
898 {
899     const int pageSize = 4096;
900     for (volatile char* p = reinterpret_cast<char*>(&stackLimit); p > stackLimit; p -= pageSize) {
901         char ch = *p;
902         *p = ch;
903     }
904 }
905 #endif
906
907 inline void VM::updateStackLimits()
908 {
909 #if OS(WINDOWS)
910     void* lastSoftStackLimit = m_softStackLimit;
911 #endif
912
913     const StackBounds& stack = Thread::current().stack();
914     size_t reservedZoneSize = Options::reservedZoneSize();
915     // We should have already ensured that Options::reservedZoneSize() >= minimumReserveZoneSize at
916     // options initialization time, and the option value should not have been changed thereafter.
917     // We don't have the ability to assert here that it hasn't changed, but we can at least assert
918     // that the value is sane.
919     RELEASE_ASSERT(reservedZoneSize >= minimumReservedZoneSize);
920
921     if (m_stackPointerAtVMEntry) {
922         ASSERT(stack.isGrowingDownward());
923         char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
924         m_softStackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), m_currentSoftReservedZoneSize);
925         m_stackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), reservedZoneSize);
926     } else {
927         m_softStackLimit = stack.recursionLimit(m_currentSoftReservedZoneSize);
928         m_stackLimit = stack.recursionLimit(reservedZoneSize);
929     }
930
931 #if OS(WINDOWS)
932     // We only need to precommit stack memory dictated by the VM::m_softStackLimit limit.
933     // This is because VM::m_softStackLimit applies to stack usage by LLINT asm or JIT
934     // generated code which can allocate stack space that the C++ compiler does not know
935     // about. As such, we have to precommit that stack memory manually.
936     //
937     // In contrast, we do not need to worry about VM::m_stackLimit because that limit is
938     // used exclusively by C++ code, and the C++ compiler will automatically commit the
939     // needed stack pages.
940     if (lastSoftStackLimit != m_softStackLimit)
941         preCommitStackMemory(m_softStackLimit);
942 #endif
943 }
944
945 #if ENABLE(DFG_JIT)
946 void VM::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
947 {
948     auto lock = holdLock(m_scratchBufferLock);
949     for (auto* scratchBuffer : m_scratchBuffers) {
950         if (scratchBuffer->activeLength()) {
951             void* bufferStart = scratchBuffer->dataBuffer();
952             conservativeRoots.add(bufferStart, static_cast<void*>(static_cast<char*>(bufferStart) + scratchBuffer->activeLength()));
953         }
954     }
955 }
956 #endif
957
958 void logSanitizeStack(VM* vm)
959 {
960     if (Options::verboseSanitizeStack() && vm->topCallFrame) {
961         int dummy;
962         auto& stackBounds = Thread::current().stack();
963         dataLog(
964             "Sanitizing stack for VM = ", RawPointer(vm), " with top call frame at ", RawPointer(vm->topCallFrame),
965             ", current stack pointer at ", RawPointer(&dummy), ", in ",
966             pointerDump(vm->topCallFrame->codeBlock()), ", last code origin = ",
967             vm->topCallFrame->codeOrigin(), ", last stack top = ", RawPointer(vm->lastStackTop()), ", in stack range [", RawPointer(stackBounds.origin()), ", ", RawPointer(stackBounds.end()), "]\n");
968     }
969 }
970
971 #if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
972 char* VM::acquireRegExpPatternContexBuffer()
973 {
974     m_regExpPatternContextLock.lock();
975     ASSERT(m_regExpPatternContextLock.isLocked());
976     if (!m_regExpPatternContexBuffer)
977         m_regExpPatternContexBuffer = makeUniqueArray<char>(VM::patternContextBufferSize);
978     return m_regExpPatternContexBuffer.get();
979 }
980
981 void VM::releaseRegExpPatternContexBuffer()
982 {
983     ASSERT(m_regExpPatternContextLock.isLocked());
984
985     m_regExpPatternContextLock.unlock();
986 }
987 #endif
988
989 #if ENABLE(REGEXP_TRACING)
990 void VM::addRegExpToTrace(RegExp* regExp)
991 {
992     gcProtect(regExp);
993     m_rtTraceList->add(regExp);
994 }
995
996 void VM::dumpRegExpTrace()
997 {
998     // The first RegExp object is ignored.  It is create by the RegExpPrototype ctor and not used.
999     RTTraceList::iterator iter = ++m_rtTraceList->begin();
1000     
1001     if (iter != m_rtTraceList->end()) {
1002         dataLogF("\nRegExp Tracing\n");
1003         dataLogF("Regular Expression                              8 Bit          16 Bit        match()    Matches    Average\n");
1004         dataLogF(" <Match only / Match>                         JIT Addr      JIT Address       calls      found   String len\n");
1005         dataLogF("----------------------------------------+----------------+----------------+----------+----------+-----------\n");
1006     
1007         unsigned reCount = 0;
1008     
1009         for (; iter != m_rtTraceList->end(); ++iter, ++reCount) {
1010             (*iter)->printTraceData();
1011             gcUnprotect(*iter);
1012         }
1013
1014         dataLogF("%d Regular Expressions\n", reCount);
1015     }
1016     
1017     m_rtTraceList->clear();
1018 }
1019 #else
1020 void VM::dumpRegExpTrace()
1021 {
1022 }
1023 #endif
1024
1025 WatchpointSet* VM::ensureWatchpointSetForImpureProperty(const Identifier& propertyName)
1026 {
1027     auto result = m_impurePropertyWatchpointSets.add(propertyName.string(), nullptr);
1028     if (result.isNewEntry)
1029         result.iterator->value = adoptRef(new WatchpointSet(IsWatched));
1030     return result.iterator->value.get();
1031 }
1032
1033 void VM::registerWatchpointForImpureProperty(const Identifier& propertyName, Watchpoint* watchpoint)
1034 {
1035     ensureWatchpointSetForImpureProperty(propertyName)->add(watchpoint);
1036 }
1037
1038 void VM::addImpureProperty(const String& propertyName)
1039 {
1040     if (RefPtr<WatchpointSet> watchpointSet = m_impurePropertyWatchpointSets.take(propertyName))
1041         watchpointSet->fireAll(*this, "Impure property added");
1042 }
1043
1044 template<typename Func>
1045 static bool enableProfilerWithRespectToCount(unsigned& counter, const Func& doEnableWork)
1046 {
1047     bool needsToRecompile = false;
1048     if (!counter) {
1049         doEnableWork();
1050         needsToRecompile = true;
1051     }
1052     counter++;
1053
1054     return needsToRecompile;
1055 }
1056
1057 template<typename Func>
1058 static bool disableProfilerWithRespectToCount(unsigned& counter, const Func& doDisableWork)
1059 {
1060     RELEASE_ASSERT(counter > 0);
1061     bool needsToRecompile = false;
1062     counter--;
1063     if (!counter) {
1064         doDisableWork();
1065         needsToRecompile = true;
1066     }
1067
1068     return needsToRecompile;
1069 }
1070
1071 bool VM::enableTypeProfiler()
1072 {
1073     auto enableTypeProfiler = [this] () {
1074         this->m_typeProfiler = std::make_unique<TypeProfiler>();
1075         this->m_typeProfilerLog = std::make_unique<TypeProfilerLog>(*this);
1076     };
1077
1078     return enableProfilerWithRespectToCount(m_typeProfilerEnabledCount, enableTypeProfiler);
1079 }
1080
1081 bool VM::disableTypeProfiler()
1082 {
1083     auto disableTypeProfiler = [this] () {
1084         this->m_typeProfiler.reset(nullptr);
1085         this->m_typeProfilerLog.reset(nullptr);
1086     };
1087
1088     return disableProfilerWithRespectToCount(m_typeProfilerEnabledCount, disableTypeProfiler);
1089 }
1090
1091 bool VM::enableControlFlowProfiler()
1092 {
1093     auto enableControlFlowProfiler = [this] () {
1094         this->m_controlFlowProfiler = std::make_unique<ControlFlowProfiler>();
1095     };
1096
1097     return enableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, enableControlFlowProfiler);
1098 }
1099
1100 bool VM::disableControlFlowProfiler()
1101 {
1102     auto disableControlFlowProfiler = [this] () {
1103         this->m_controlFlowProfiler.reset(nullptr);
1104     };
1105
1106     return disableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, disableControlFlowProfiler);
1107 }
1108
1109 void VM::dumpTypeProfilerData()
1110 {
1111     if (!typeProfiler())
1112         return;
1113
1114     typeProfilerLog()->processLogEntries("VM Dump Types"_s);
1115     typeProfiler()->dumpTypeProfilerData(*this);
1116 }
1117
1118 void VM::queueMicrotask(JSGlobalObject& globalObject, Ref<Microtask>&& task)
1119 {
1120     m_microtaskQueue.append(std::make_unique<QueuedTask>(*this, &globalObject, WTFMove(task)));
1121 }
1122
1123 void VM::drainMicrotasks()
1124 {
1125     while (!m_microtaskQueue.isEmpty())
1126         m_microtaskQueue.takeFirst()->run();
1127 }
1128
1129 void QueuedTask::run()
1130 {
1131     m_microtask->run(m_globalObject->globalExec());
1132 }
1133
1134 void sanitizeStackForVM(VM* vm)
1135 {
1136     logSanitizeStack(vm);
1137     if (vm->topCallFrame) {
1138         auto& stackBounds = Thread::current().stack();
1139         ASSERT(vm->currentThreadIsHoldingAPILock());
1140         ASSERT_UNUSED(stackBounds, stackBounds.contains(vm->lastStackTop()));
1141     }
1142 #if !ENABLE(JIT)
1143     vm->interpreter->cloopStack().sanitizeStack();
1144 #else
1145     sanitizeStackForVMImpl(vm);
1146 #endif
1147 }
1148
1149 size_t VM::committedStackByteCount()
1150 {
1151 #if ENABLE(JIT)
1152     // When using the C stack, we don't know how many stack pages are actually
1153     // committed. So, we use the current stack usage as an estimate.
1154     ASSERT(Thread::current().stack().isGrowingDownward());
1155     int8_t* current = reinterpret_cast<int8_t*>(&current);
1156     int8_t* high = reinterpret_cast<int8_t*>(Thread::current().stack().origin());
1157     return high - current;
1158 #else
1159     return CLoopStack::committedByteCount();
1160 #endif
1161 }
1162
1163 #if !ENABLE(JIT)
1164 bool VM::ensureStackCapacityForCLoop(Register* newTopOfStack)
1165 {
1166     return interpreter->cloopStack().ensureCapacityFor(newTopOfStack);
1167 }
1168
1169 bool VM::isSafeToRecurseSoftCLoop() const
1170 {
1171     return interpreter->cloopStack().isSafeToRecurse();
1172 }
1173 #endif // !ENABLE(JIT)
1174
1175 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
1176 void VM::verifyExceptionCheckNeedIsSatisfied(unsigned recursionDepth, ExceptionEventLocation& location)
1177 {
1178     if (!Options::validateExceptionChecks())
1179         return;
1180
1181     if (UNLIKELY(m_needExceptionCheck)) {
1182         auto throwDepth = m_simulatedThrowPointRecursionDepth;
1183         auto& throwLocation = m_simulatedThrowPointLocation;
1184
1185         dataLog(
1186             "ERROR: Unchecked JS exception:\n"
1187             "    This scope can throw a JS exception: ", throwLocation, "\n"
1188             "        (ExceptionScope::m_recursionDepth was ", throwDepth, ")\n"
1189             "    But the exception was unchecked as of this scope: ", location, "\n"
1190             "        (ExceptionScope::m_recursionDepth was ", recursionDepth, ")\n"
1191             "\n");
1192
1193         StringPrintStream out;
1194         std::unique_ptr<StackTrace> currentTrace = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
1195
1196         if (Options::dumpSimulatedThrows()) {
1197             out.println("The simulated exception was thrown at:");
1198             m_nativeStackTraceOfLastSimulatedThrow->dump(out, "    ");
1199             out.println();
1200         }
1201         out.println("Unchecked exception detected at:");
1202         currentTrace->dump(out, "    ");
1203         out.println();
1204
1205         dataLog(out.toCString());
1206         RELEASE_ASSERT(!m_needExceptionCheck);
1207     }
1208 }
1209 #endif
1210
1211 #if USE(CF)
1212 void VM::registerRunLoopTimer(JSRunLoopTimer* timer)
1213 {
1214     ASSERT(runLoop());
1215     ASSERT(!m_runLoopTimers.contains(timer));
1216     m_runLoopTimers.add(timer);
1217     timer->setRunLoop(runLoop());
1218 }
1219
1220 void VM::unregisterRunLoopTimer(JSRunLoopTimer* timer)
1221 {
1222     ASSERT(m_runLoopTimers.contains(timer));
1223     m_runLoopTimers.remove(timer);
1224     timer->setRunLoop(nullptr);
1225 }
1226
1227 void VM::setRunLoop(CFRunLoopRef runLoop)
1228 {
1229     ASSERT(runLoop);
1230     m_runLoop = runLoop;
1231     for (auto timer : m_runLoopTimers)
1232         timer->setRunLoop(runLoop);
1233 }
1234 #endif // USE(CF)
1235
1236 ScratchBuffer* VM::scratchBufferForSize(size_t size)
1237 {
1238     if (!size)
1239         return nullptr;
1240
1241     auto locker = holdLock(m_scratchBufferLock);
1242
1243     if (size > m_sizeOfLastScratchBuffer) {
1244         // Protect against a N^2 memory usage pathology by ensuring
1245         // that at worst, we get a geometric series, meaning that the
1246         // total memory usage is somewhere around
1247         // max(scratch buffer size) * 4.
1248         m_sizeOfLastScratchBuffer = size * 2;
1249
1250         ScratchBuffer* newBuffer = ScratchBuffer::create(m_sizeOfLastScratchBuffer);
1251         RELEASE_ASSERT(newBuffer);
1252         m_scratchBuffers.append(newBuffer);
1253     }
1254
1255     ScratchBuffer* result = m_scratchBuffers.last();
1256     return result;
1257 }
1258
1259 void VM::clearScratchBuffers()
1260 {
1261     auto lock = holdLock(m_scratchBufferLock);
1262     for (auto* scratchBuffer : m_scratchBuffers)
1263         scratchBuffer->setActiveLength(0);
1264 }
1265
1266 } // namespace JSC