We should have a CoW storage for NewArrayBuffer arrays.
[WebKit-https.git] / Source / JavaScriptCore / runtime / VM.cpp
1 /*
2  * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer. 
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution. 
13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission. 
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28
29 #include "config.h"
30 #include "VM.h"
31
32 #include "ArgList.h"
33 #include "ArrayBufferNeuteringWatchpoint.h"
34 #include "BuiltinExecutables.h"
35 #include "BytecodeIntrinsicRegistry.h"
36 #include "CodeBlock.h"
37 #include "CodeCache.h"
38 #include "CommonIdentifiers.h"
39 #include "CommonSlowPaths.h"
40 #include "CustomGetterSetter.h"
41 #include "DFGWorklist.h"
42 #include "DirectEvalExecutable.h"
43 #include "Disassembler.h"
44 #include "Error.h"
45 #include "ErrorConstructor.h"
46 #include "ErrorInstance.h"
47 #include "EvalCodeBlock.h"
48 #include "Exception.h"
49 #include "ExecutableToCodeBlockEdge.h"
50 #include "FTLThunks.h"
51 #include "FastMallocAlignedMemoryAllocator.h"
52 #include "FunctionCodeBlock.h"
53 #include "FunctionConstructor.h"
54 #include "FunctionExecutable.h"
55 #include "GCActivityCallback.h"
56 #include "GetterSetter.h"
57 #include "GigacageAlignedMemoryAllocator.h"
58 #include "HasOwnPropertyCache.h"
59 #include "Heap.h"
60 #include "HeapIterationScope.h"
61 #include "HeapProfiler.h"
62 #include "HostCallReturnValue.h"
63 #include "Identifier.h"
64 #include "IncrementalSweeper.h"
65 #include "IndirectEvalExecutable.h"
66 #include "InferredTypeTable.h"
67 #include "InferredValue.h"
68 #include "Interpreter.h"
69 #include "IntlCollatorConstructor.h"
70 #include "IntlDateTimeFormatConstructor.h"
71 #include "IntlNumberFormatConstructor.h"
72 #include "IntlPluralRulesConstructor.h"
73 #include "JITCode.h"
74 #include "JITWorklist.h"
75 #include "JSAPIValueWrapper.h"
76 #include "JSArray.h"
77 #include "JSArrayBufferConstructor.h"
78 #include "JSAsyncFunction.h"
79 #include "JSBigInt.h"
80 #include "JSBoundFunction.h"
81 #include "JSCInlines.h"
82 #include "JSCallbackFunction.h"
83 #include "JSCustomGetterSetterFunction.h"
84 #include "JSDestructibleObjectHeapCellType.h"
85 #include "JSFixedArray.h"
86 #include "JSFunction.h"
87 #include "JSGlobalObjectFunctions.h"
88 #include "JSImmutableButterfly.h"
89 #include "JSInternalPromiseDeferred.h"
90 #include "JSLock.h"
91 #include "JSMap.h"
92 #include "JSMapIterator.h"
93 #include "JSPromiseDeferred.h"
94 #include "JSPropertyNameEnumerator.h"
95 #include "JSSegmentedVariableObjectHeapCellType.h"
96 #include "JSScriptFetchParameters.h"
97 #include "JSScriptFetcher.h"
98 #include "JSSet.h"
99 #include "JSSetIterator.h"
100 #include "JSSourceCode.h"
101 #include "JSStringHeapCellType.h"
102 #include "JSTemplateObjectDescriptor.h"
103 #include "JSWeakMap.h"
104 #include "JSWeakSet.h"
105 #include "JSWebAssembly.h"
106 #include "JSWebAssemblyCodeBlock.h"
107 #include "JSWebAssemblyCodeBlockHeapCellType.h"
108 #include "JSWithScope.h"
109 #include "LLIntData.h"
110 #include "Lexer.h"
111 #include "Lookup.h"
112 #include "MinimumReservedZoneSize.h"
113 #include "ModuleProgramCodeBlock.h"
114 #include "ModuleProgramExecutable.h"
115 #include "NativeErrorConstructor.h"
116 #include "NativeExecutable.h"
117 #include "NativeStdFunctionCell.h"
118 #include "Nodes.h"
119 #include "ObjCCallbackFunction.h"
120 #include "Parser.h"
121 #include "ProfilerDatabase.h"
122 #include "ProgramCodeBlock.h"
123 #include "ProgramExecutable.h"
124 #include "PromiseDeferredTimer.h"
125 #include "PropertyMapHashTable.h"
126 #include "ProxyRevoke.h"
127 #include "RegExpCache.h"
128 #include "RegExpConstructor.h"
129 #include "RegExpObject.h"
130 #include "RegisterAtOffsetList.h"
131 #include "RuntimeType.h"
132 #include "SamplingProfiler.h"
133 #include "ShadowChicken.h"
134 #include "SimpleTypedArrayController.h"
135 #include "SourceProviderCache.h"
136 #include "StackVisitor.h"
137 #include "StrictEvalActivation.h"
138 #include "StrongInlines.h"
139 #include "StructureInlines.h"
140 #include "TestRunnerUtils.h"
141 #include "ThreadLocalCacheInlines.h"
142 #include "ThunkGenerators.h"
143 #include "TypeProfiler.h"
144 #include "TypeProfilerLog.h"
145 #include "UnlinkedCodeBlock.h"
146 #include "VMEntryScope.h"
147 #include "VMInspector.h"
148 #include "VariableEnvironment.h"
149 #include "WasmWorklist.h"
150 #include "Watchdog.h"
151 #include "WeakGCMapInlines.h"
152 #include "WebAssemblyFunction.h"
153 #include "WebAssemblyWrapperFunction.h"
154 #include <wtf/ProcessID.h>
155 #include <wtf/ReadWriteLock.h>
156 #include <wtf/SimpleStats.h>
157 #include <wtf/StringPrintStream.h>
158 #include <wtf/Threading.h>
159 #include <wtf/text/AtomicStringTable.h>
160 #include <wtf/text/SymbolRegistry.h>
161
162 #if !ENABLE(JIT)
163 #include "CLoopStack.h"
164 #include "CLoopStackInlines.h"
165 #endif
166
167 #if ENABLE(DFG_JIT)
168 #include "ConservativeRoots.h"
169 #endif
170
171 #if ENABLE(REGEXP_TRACING)
172 #include "RegExp.h"
173 #endif
174
175 using namespace WTF;
176
177 namespace JSC {
178
179 // Note: Platform.h will enforce that ENABLE(ASSEMBLER) is true if either
180 // ENABLE(JIT) or ENABLE(YARR_JIT) or both are enabled. The code below
181 // just checks for ENABLE(JIT) or ENABLE(YARR_JIT) with this premise in mind.
182
183 #if ENABLE(ASSEMBLER)
184 static bool enableAssembler(ExecutableAllocator& executableAllocator)
185 {
186     if (!Options::useJIT() && !Options::useRegExpJIT())
187         return false;
188
189     if (!executableAllocator.isValid()) {
190         if (Options::crashIfCantAllocateJITMemory())
191             CRASH();
192         return false;
193     }
194
195     char* canUseJITString = getenv("JavaScriptCoreUseJIT");
196     return !canUseJITString || atoi(canUseJITString);
197 }
198 #endif // ENABLE(!ASSEMBLER)
199
200 bool VM::canUseAssembler()
201 {
202 #if ENABLE(ASSEMBLER)
203     static std::once_flag onceKey;
204     static bool enabled = false;
205     std::call_once(onceKey, [] {
206         enabled = enableAssembler(ExecutableAllocator::singleton());
207     });
208     return enabled;
209 #else
210     return false; // interpreter only
211 #endif
212 }
213
214 bool VM::canUseJIT()
215 {
216 #if ENABLE(JIT)
217     static std::once_flag onceKey;
218     static bool enabled = false;
219     std::call_once(onceKey, [] {
220         enabled = VM::canUseAssembler() && Options::useJIT();
221     });
222     return enabled;
223 #else
224     return false; // interpreter only
225 #endif
226 }
227
228 bool VM::canUseRegExpJIT()
229 {
230 #if ENABLE(YARR_JIT)
231     static std::once_flag onceKey;
232     static bool enabled = false;
233     std::call_once(onceKey, [] {
234         enabled = VM::canUseAssembler() && Options::useRegExpJIT();
235     });
236     return enabled;
237 #else
238     return false; // interpreter only
239 #endif
240 }
241
242 VM::VM(VMType vmType, HeapType heapType)
243     : m_apiLock(adoptRef(new JSLock(this)))
244 #if USE(CF)
245     , m_runLoop(CFRunLoopGetCurrent())
246 #endif // USE(CF)
247     , heap(this, heapType)
248     , fastMallocAllocator(std::make_unique<FastMallocAlignedMemoryAllocator>())
249     , primitiveGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::Primitive))
250     , jsValueGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::JSValue))
251     , auxiliaryHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::Auxiliary)))
252     , cellJSValueOOBHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
253     , cellDangerousBitsHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
254     , destructibleCellHeapCellType(std::make_unique<HeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)))
255     , stringHeapCellType(std::make_unique<JSStringHeapCellType>())
256     , destructibleObjectHeapCellType(std::make_unique<JSDestructibleObjectHeapCellType>())
257     , segmentedVariableObjectHeapCellType(std::make_unique<JSSegmentedVariableObjectHeapCellType>())
258 #if ENABLE(WEBASSEMBLY)
259     , webAssemblyCodeBlockHeapCellType(std::make_unique<JSWebAssemblyCodeBlockHeapCellType>())
260 #endif
261     , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get())
262     , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get())
263     , cellJSValueOOBSpace("JSCell JSValueOOB", heap, cellJSValueOOBHeapCellType.get(), fastMallocAllocator.get())
264     , cellDangerousBitsSpace("JSCell DangerousBits", heap, cellDangerousBitsHeapCellType.get(), fastMallocAllocator.get())
265     , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellJSValueOOBHeapCellType.get(), jsValueGigacageAllocator.get())
266     , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get())
267     , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get())
268     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
269     , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
270     , segmentedVariableObjectSpace("JSSegmentedVariableObjectSpace", heap, segmentedVariableObjectHeapCellType.get(), fastMallocAllocator.get())
271     , arrayBufferConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSArrayBufferConstructor)
272     , asyncFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncFunction)
273     , asyncGeneratorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncGeneratorFunction)
274     , boundFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSBoundFunction)
275     , callbackFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSCallbackFunction)
276     , customGetterSetterFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSCustomGetterSetterFunction)
277     , directEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), DirectEvalExecutable)
278     , errorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ErrorConstructor)
279     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellDangerousBitsHeapCellType.get(), ExecutableToCodeBlockEdge)
280     , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
281     , functionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSFunction)
282     , generatorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSGeneratorFunction)
283     , indirectEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), IndirectEvalExecutable)
284     , inferredTypeSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredType)
285     , inferredValueSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredValue)
286     , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
287 #if ENABLE(INTL)
288     , intlCollatorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlCollatorConstructor)
289     , intlDateTimeFormatConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlDateTimeFormatConstructor)
290     , intlNumberFormatConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlNumberFormatConstructor)
291     , intlPluralRulesConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlPluralRulesConstructor)
292 #endif
293     , moduleProgramExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramExecutable)
294     , nativeErrorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), NativeErrorConstructor)
295     , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable)
296     , nativeStdFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSNativeStdFunction)
297 #if JSC_OBJC_API_ENABLED
298     , objCCallbackFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ObjCCallbackFunction)
299 #endif
300     , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable)
301     , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable)
302     , proxyRevokeSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ProxyRevoke)
303     , regExpConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), RegExpConstructor)
304     , strictModeTypeErrorFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), StrictModeTypeErrorFunction)
305     , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData)
306     , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure)
307     , weakSetSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakSet)
308     , weakMapSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakMap)
309 #if ENABLE(WEBASSEMBLY)
310     , webAssemblyCodeBlockSpace ISO_SUBSPACE_INIT(heap, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock)
311     , webAssemblyFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyFunction)
312     , webAssemblyWrapperFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyWrapperFunction)
313 #endif
314     , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
315     , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
316     , inferredTypesWithFinalizers(inferredTypeSpace)
317     , inferredValuesWithFinalizers(inferredValueSpace)
318     , evalCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), EvalCodeBlock)
319     , functionCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionCodeBlock)
320     , moduleProgramCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramCodeBlock)
321     , programCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramCodeBlock)
322     , vmType(vmType)
323     , clientData(0)
324     , topEntryFrame(nullptr)
325     , topCallFrame(CallFrame::noCaller())
326     , promiseDeferredTimer(std::make_unique<PromiseDeferredTimer>(*this))
327     , m_atomicStringTable(vmType == Default ? Thread::current().atomicStringTable() : new AtomicStringTable)
328     , propertyNames(nullptr)
329     , emptyList(new ArgList)
330     , machineCodeBytesPerBytecodeWordForBaselineJIT(std::make_unique<SimpleStats>())
331     , customGetterSetterFunctionMap(*this)
332     , stringCache(*this)
333     , symbolImplToSymbolMap(*this)
334     , structureCache(*this)
335     , interpreter(0)
336     , entryScope(0)
337     , m_regExpCache(new RegExpCache(this))
338     , m_compactVariableMap(adoptRef(*(new CompactVariableMap)))
339 #if ENABLE(REGEXP_TRACING)
340     , m_rtTraceList(new RTTraceList())
341 #endif
342 #if ENABLE(GC_VALIDATION)
343     , m_initializingObjectClass(0)
344 #endif
345     , m_stackPointerAtVMEntry(0)
346     , m_codeCache(std::make_unique<CodeCache>())
347     , m_builtinExecutables(std::make_unique<BuiltinExecutables>(*this))
348     , m_typeProfilerEnabledCount(0)
349     , m_primitiveGigacageEnabled(IsWatched)
350     , m_controlFlowProfilerEnabledCount(0)
351     , m_shadowChicken(std::make_unique<ShadowChicken>())
352 {
353     interpreter = new Interpreter(*this);
354     StackBounds stack = Thread::current().stack();
355     updateSoftReservedZoneSize(Options::softReservedZoneSize());
356     setLastStackTop(stack.origin());
357
358     defaultThreadLocalCache = ThreadLocalCache::create(heap);
359     defaultThreadLocalCache->install(*this);
360
361     // Need to be careful to keep everything consistent here
362     JSLockHolder lock(this);
363     AtomicStringTable* existingEntryAtomicStringTable = Thread::current().setCurrentAtomicStringTable(m_atomicStringTable);
364     propertyNames = new CommonIdentifiers(this);
365     structureStructure.set(*this, Structure::createStructure(*this));
366     structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
367     terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
368     stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
369     propertyNameEnumeratorStructure.set(*this, JSPropertyNameEnumerator::createStructure(*this, 0, jsNull()));
370     customGetterSetterStructure.set(*this, CustomGetterSetter::createStructure(*this, 0, jsNull()));
371     domAttributeGetterSetterStructure.set(*this, DOMAttributeGetterSetter::createStructure(*this, 0, jsNull()));
372     scopedArgumentsTableStructure.set(*this, ScopedArgumentsTable::createStructure(*this, 0, jsNull()));
373     apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, 0, jsNull()));
374     nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, 0, jsNull()));
375     evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, 0, jsNull()));
376     programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, 0, jsNull()));
377     functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, 0, jsNull()));
378 #if ENABLE(WEBASSEMBLY)
379     webAssemblyCodeBlockStructure.set(*this, JSWebAssemblyCodeBlock::createStructure(*this, 0, jsNull()));
380 #endif
381     moduleProgramExecutableStructure.set(*this, ModuleProgramExecutable::createStructure(*this, 0, jsNull()));
382     regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
383     symbolStructure.set(*this, Symbol::createStructure(*this, 0, jsNull()));
384     symbolTableStructure.set(*this, SymbolTable::createStructure(*this, 0, jsNull()));
385     fixedArrayStructure.set(*this, JSFixedArray::createStructure(*this, 0, jsNull()));
386
387     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithInt32) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithInt32));
388     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithDouble) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithDouble));
389     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithContiguous) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithContiguous));
390
391     sourceCodeStructure.set(*this, JSSourceCode::createStructure(*this, 0, jsNull()));
392     scriptFetcherStructure.set(*this, JSScriptFetcher::createStructure(*this, 0, jsNull()));
393     scriptFetchParametersStructure.set(*this, JSScriptFetchParameters::createStructure(*this, 0, jsNull()));
394     structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
395     sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
396     templateObjectDescriptorStructure.set(*this, JSTemplateObjectDescriptor::createStructure(*this, 0, jsNull()));
397     arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpoint::createStructure(*this));
398     unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
399     unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
400     unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
401     unlinkedFunctionCodeBlockStructure.set(*this, UnlinkedFunctionCodeBlock::createStructure(*this, 0, jsNull()));
402     unlinkedModuleProgramCodeBlockStructure.set(*this, UnlinkedModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
403     propertyTableStructure.set(*this, PropertyTable::createStructure(*this, 0, jsNull()));
404     inferredTypeStructure.set(*this, InferredType::createStructure(*this, 0, jsNull()));
405     inferredTypeTableStructure.set(*this, InferredTypeTable::createStructure(*this, 0, jsNull()));
406     inferredValueStructure.set(*this, InferredValue::createStructure(*this, 0, jsNull()));
407     functionRareDataStructure.set(*this, FunctionRareData::createStructure(*this, 0, jsNull()));
408     exceptionStructure.set(*this, Exception::createStructure(*this, 0, jsNull()));
409     promiseDeferredStructure.set(*this, JSPromiseDeferred::createStructure(*this, 0, jsNull()));
410     internalPromiseDeferredStructure.set(*this, JSInternalPromiseDeferred::createStructure(*this, 0, jsNull()));
411     programCodeBlockStructure.set(*this, ProgramCodeBlock::createStructure(*this, 0, jsNull()));
412     moduleProgramCodeBlockStructure.set(*this, ModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
413     evalCodeBlockStructure.set(*this, EvalCodeBlock::createStructure(*this, 0, jsNull()));
414     functionCodeBlockStructure.set(*this, FunctionCodeBlock::createStructure(*this, 0, jsNull()));
415     hashMapBucketSetStructure.set(*this, HashMapBucket<HashMapBucketDataKey>::createStructure(*this, 0, jsNull()));
416     hashMapBucketMapStructure.set(*this, HashMapBucket<HashMapBucketDataKeyValue>::createStructure(*this, 0, jsNull()));
417     setIteratorStructure.set(*this, JSSetIterator::createStructure(*this, 0, jsNull()));
418     mapIteratorStructure.set(*this, JSMapIterator::createStructure(*this, 0, jsNull()));
419     bigIntStructure.set(*this, JSBigInt::createStructure(*this, 0, jsNull()));
420     executableToCodeBlockEdgeStructure.set(*this, ExecutableToCodeBlockEdge::createStructure(*this, nullptr, jsNull()));
421
422     sentinelSetBucket.set(*this, JSSet::BucketType::createSentinel(*this));
423     sentinelMapBucket.set(*this, JSMap::BucketType::createSentinel(*this));
424
425     nativeStdFunctionCellStructure.set(*this, NativeStdFunctionCell::createStructure(*this, 0, jsNull()));
426     smallStrings.initializeCommonStrings(*this);
427
428     Thread::current().setCurrentAtomicStringTable(existingEntryAtomicStringTable);
429
430 #if ENABLE(JIT)
431     jitStubs = std::make_unique<JITThunks>();
432 #endif
433
434 #if ENABLE(FTL_JIT)
435     ftlThunks = std::make_unique<FTL::Thunks>();
436 #endif // ENABLE(FTL_JIT)
437     
438 #if ENABLE(JIT)
439     initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
440 #endif
441     
442     Gigacage::addPrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
443
444     heap.notifyIsSafeToCollect();
445     
446     LLInt::Data::performAssertions(*this);
447     
448     if (UNLIKELY(Options::useProfiler())) {
449         m_perBytecodeProfiler = std::make_unique<Profiler::Database>(*this);
450
451         StringPrintStream pathOut;
452         const char* profilerPath = getenv("JSC_PROFILER_PATH");
453         if (profilerPath)
454             pathOut.print(profilerPath, "/");
455         pathOut.print("JSCProfile-", getCurrentProcessID(), "-", m_perBytecodeProfiler->databaseID(), ".json");
456         m_perBytecodeProfiler->registerToSaveAtExit(pathOut.toCString().data());
457     }
458
459     callFrameForCatch = nullptr;
460
461     // Initialize this last, as a free way of asserting that VM initialization itself
462     // won't use this.
463     m_typedArrayController = adoptRef(new SimpleTypedArrayController());
464
465     m_bytecodeIntrinsicRegistry = std::make_unique<BytecodeIntrinsicRegistry>(*this);
466
467     if (Options::useTypeProfiler())
468         enableTypeProfiler();
469     if (Options::useControlFlowProfiler())
470         enableControlFlowProfiler();
471 #if ENABLE(SAMPLING_PROFILER)
472     if (Options::useSamplingProfiler()) {
473         setShouldBuildPCToCodeOriginMapping();
474         Ref<Stopwatch> stopwatch = Stopwatch::create();
475         stopwatch->start();
476         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
477         if (Options::samplingProfilerPath())
478             m_samplingProfiler->registerForReportAtExit();
479         m_samplingProfiler->start();
480     }
481 #endif // ENABLE(SAMPLING_PROFILER)
482
483     if (Options::alwaysGeneratePCToCodeOriginMap())
484         setShouldBuildPCToCodeOriginMapping();
485
486     if (Options::watchdog()) {
487         Watchdog& watchdog = ensureWatchdog();
488         watchdog.setTimeLimit(Seconds::fromMilliseconds(Options::watchdog()));
489     }
490
491 #if ENABLE(JIT)
492     // Make sure that any stubs that the JIT is going to use are initialized in non-compilation threads.
493     if (canUseJIT()) {
494         getCTIInternalFunctionTrampolineFor(CodeForCall);
495         getCTIInternalFunctionTrampolineFor(CodeForConstruct);
496     }
497 #endif
498
499     if (!canUseJIT())
500         noJITValueProfileSingleton = std::make_unique<ValueProfile>(0);
501
502     VMInspector::instance().add(this);
503 }
504
505 static ReadWriteLock s_destructionLock;
506
507 void waitForVMDestruction()
508 {
509     auto locker = holdLock(s_destructionLock.write());
510 }
511
512 VM::~VM()
513 {
514     auto destructionLocker = holdLock(s_destructionLock.read());
515     
516     Gigacage::removePrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
517     promiseDeferredTimer->stopRunningTasks();
518 #if ENABLE(WEBASSEMBLY)
519     if (Wasm::existingWorklistOrNull())
520         Wasm::ensureWorklist().stopAllPlansForContext(wasmContext);
521 #endif
522     if (UNLIKELY(m_watchdog))
523         m_watchdog->willDestroyVM(this);
524     m_traps.willDestroyVM();
525     VMInspector::instance().remove(this);
526
527     // Never GC, ever again.
528     heap.incrementDeferralDepth();
529
530 #if ENABLE(SAMPLING_PROFILER)
531     if (m_samplingProfiler) {
532         m_samplingProfiler->reportDataToOptionFile();
533         m_samplingProfiler->shutdown();
534     }
535 #endif // ENABLE(SAMPLING_PROFILER)
536     
537 #if ENABLE(JIT)
538     JITWorklist::instance()->completeAllForVM(*this);
539 #endif // ENABLE(JIT)
540
541 #if ENABLE(DFG_JIT)
542     // Make sure concurrent compilations are done, but don't install them, since there is
543     // no point to doing so.
544     for (unsigned i = DFG::numberOfWorklists(); i--;) {
545         if (DFG::Worklist* worklist = DFG::existingWorklistForIndexOrNull(i)) {
546             worklist->removeNonCompilingPlansForVM(*this);
547             worklist->waitUntilAllPlansForVMAreReady(*this);
548             worklist->removeAllReadyPlansForVM(*this);
549         }
550     }
551 #endif // ENABLE(DFG_JIT)
552     
553     waitForAsynchronousDisassembly();
554     
555     // Clear this first to ensure that nobody tries to remove themselves from it.
556     m_perBytecodeProfiler = nullptr;
557
558     ASSERT(currentThreadIsHoldingAPILock());
559     m_apiLock->willDestroyVM(this);
560     heap.lastChanceToFinalize();
561     
562 #if !USE(FAST_TLS_FOR_TLC)
563     ThreadLocalCache::destructor(threadLocalCacheData);
564 #endif
565
566     delete interpreter;
567 #ifndef NDEBUG
568     interpreter = reinterpret_cast<Interpreter*>(0xbbadbeef);
569 #endif
570
571     delete emptyList;
572
573     delete propertyNames;
574     if (vmType != Default)
575         delete m_atomicStringTable;
576
577     delete clientData;
578     delete m_regExpCache;
579
580 #if ENABLE(REGEXP_TRACING)
581     delete m_rtTraceList;
582 #endif
583
584 #if ENABLE(DFG_JIT)
585     for (unsigned i = 0; i < m_scratchBuffers.size(); ++i)
586         fastFree(m_scratchBuffers[i]);
587 #endif
588 }
589
590 void VM::primitiveGigacageDisabledCallback(void* argument)
591 {
592     static_cast<VM*>(argument)->primitiveGigacageDisabled();
593 }
594
595 void VM::primitiveGigacageDisabled()
596 {
597     if (m_apiLock->currentThreadIsHoldingLock()) {
598         m_primitiveGigacageEnabled.fireAll(*this, "Primitive gigacage disabled");
599         return;
600     }
601  
602     // This is totally racy, and that's OK. The point is, it's up to the user to ensure that they pass the
603     // uncaged buffer in a nicely synchronized manner.
604     m_needToFirePrimitiveGigacageEnabled = true;
605 }
606
607 void VM::setLastStackTop(void* lastStackTop)
608
609     m_lastStackTop = lastStackTop;
610 }
611
612 Ref<VM> VM::createContextGroup(HeapType heapType)
613 {
614     return adoptRef(*new VM(APIContextGroup, heapType));
615 }
616
617 Ref<VM> VM::create(HeapType heapType)
618 {
619     return adoptRef(*new VM(Default, heapType));
620 }
621
622 bool VM::sharedInstanceExists()
623 {
624     return sharedInstanceInternal();
625 }
626
627 VM& VM::sharedInstance()
628 {
629     GlobalJSLock globalLock;
630     VM*& instance = sharedInstanceInternal();
631     if (!instance)
632         instance = adoptRef(new VM(APIShared, SmallHeap)).leakRef();
633     return *instance;
634 }
635
636 VM*& VM::sharedInstanceInternal()
637 {
638     static VM* sharedInstance;
639     return sharedInstance;
640 }
641
642 Watchdog& VM::ensureWatchdog()
643 {
644     if (!m_watchdog)
645         m_watchdog = adoptRef(new Watchdog(this));
646     return *m_watchdog;
647 }
648
649 HeapProfiler& VM::ensureHeapProfiler()
650 {
651     if (!m_heapProfiler)
652         m_heapProfiler = std::make_unique<HeapProfiler>(*this);
653     return *m_heapProfiler;
654 }
655
656 #if ENABLE(SAMPLING_PROFILER)
657 SamplingProfiler& VM::ensureSamplingProfiler(RefPtr<Stopwatch>&& stopwatch)
658 {
659     if (!m_samplingProfiler)
660         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
661     return *m_samplingProfiler;
662 }
663 #endif // ENABLE(SAMPLING_PROFILER)
664
665 #if ENABLE(JIT)
666 static ThunkGenerator thunkGeneratorForIntrinsic(Intrinsic intrinsic)
667 {
668     switch (intrinsic) {
669     case CharCodeAtIntrinsic:
670         return charCodeAtThunkGenerator;
671     case CharAtIntrinsic:
672         return charAtThunkGenerator;
673     case Clz32Intrinsic:
674         return clz32ThunkGenerator;
675     case FromCharCodeIntrinsic:
676         return fromCharCodeThunkGenerator;
677     case SqrtIntrinsic:
678         return sqrtThunkGenerator;
679     case AbsIntrinsic:
680         return absThunkGenerator;
681     case FloorIntrinsic:
682         return floorThunkGenerator;
683     case CeilIntrinsic:
684         return ceilThunkGenerator;
685     case TruncIntrinsic:
686         return truncThunkGenerator;
687     case RoundIntrinsic:
688         return roundThunkGenerator;
689     case ExpIntrinsic:
690         return expThunkGenerator;
691     case LogIntrinsic:
692         return logThunkGenerator;
693     case IMulIntrinsic:
694         return imulThunkGenerator;
695     case RandomIntrinsic:
696         return randomThunkGenerator;
697     case BoundThisNoArgsFunctionCallIntrinsic:
698         return boundThisNoArgsFunctionCallGenerator;
699     default:
700         return nullptr;
701     }
702 }
703
704 #endif // ENABLE(JIT)
705
706 NativeExecutable* VM::getHostFunction(NativeFunction function, NativeFunction constructor, const String& name)
707 {
708     return getHostFunction(function, NoIntrinsic, constructor, nullptr, name);
709 }
710
711 NativeExecutable* VM::getHostFunction(NativeFunction function, Intrinsic intrinsic, NativeFunction constructor, const DOMJIT::Signature* signature, const String& name)
712 {
713 #if ENABLE(JIT)
714     if (canUseJIT()) {
715         return jitStubs->hostFunctionStub(
716             this, function, constructor,
717             intrinsic != NoIntrinsic ? thunkGeneratorForIntrinsic(intrinsic) : 0,
718             intrinsic, signature, name);
719     }
720 #else // ENABLE(JIT)
721     UNUSED_PARAM(intrinsic);
722 #endif // ENABLE(JIT)
723     return NativeExecutable::create(*this,
724         adoptRef(*new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_call_trampoline), JITCode::HostCallThunk)), function,
725         adoptRef(*new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_construct_trampoline), JITCode::HostCallThunk)), constructor,
726         NoIntrinsic, signature, name);
727 }
728
729 MacroAssemblerCodePtr<JSEntryPtrTag> VM::getCTIInternalFunctionTrampolineFor(CodeSpecializationKind kind)
730 {
731 #if ENABLE(JIT)
732     if (canUseJIT()) {
733         if (kind == CodeForCall)
734             return jitStubs->ctiInternalFunctionCall(this).retagged<JSEntryPtrTag>();
735         return jitStubs->ctiInternalFunctionConstruct(this).retagged<JSEntryPtrTag>();
736     }
737 #endif
738     if (kind == CodeForCall)
739         return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_call_trampoline);
740     return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_construct_trampoline);
741 }
742
743 VM::ClientData::~ClientData()
744 {
745 }
746
747 void VM::resetDateCache()
748 {
749     localTimeOffsetCache.reset();
750     cachedDateString = String();
751     cachedDateStringValue = std::numeric_limits<double>::quiet_NaN();
752     dateInstanceCache.reset();
753 }
754
755 void VM::whenIdle(std::function<void()> callback)
756 {
757     if (!entryScope) {
758         callback();
759         return;
760     }
761
762     entryScope->addDidPopListener(callback);
763 }
764
765 void VM::deleteAllLinkedCode(DeleteAllCodeEffort effort)
766 {
767     whenIdle([=] () {
768         heap.deleteAllCodeBlocks(effort);
769     });
770 }
771
772 void VM::deleteAllCode(DeleteAllCodeEffort effort)
773 {
774     whenIdle([=] () {
775         m_codeCache->clear();
776         m_regExpCache->deleteAllCode();
777         heap.deleteAllCodeBlocks(effort);
778         heap.deleteAllUnlinkedCodeBlocks(effort);
779         heap.reportAbandonedObjectGraph();
780     });
781 }
782
783 void VM::shrinkFootprint()
784 {
785     sanitizeStackForVM(this);
786     deleteAllCode(DeleteAllCodeIfNotCollecting);
787     heap.collectNow(Synchronousness::Sync);
788     WTF::releaseFastMallocFreeMemory();
789     // FIXME: Consider stopping various automatic threads here.
790     // https://bugs.webkit.org/show_bug.cgi?id=185447
791 }
792
793 SourceProviderCache* VM::addSourceProviderCache(SourceProvider* sourceProvider)
794 {
795     auto addResult = sourceProviderCacheMap.add(sourceProvider, nullptr);
796     if (addResult.isNewEntry)
797         addResult.iterator->value = adoptRef(new SourceProviderCache);
798     return addResult.iterator->value.get();
799 }
800
801 void VM::clearSourceProviderCaches()
802 {
803     sourceProviderCacheMap.clear();
804 }
805
806 void VM::throwException(ExecState* exec, Exception* exception)
807 {
808     if (Options::breakOnThrow()) {
809         CodeBlock* codeBlock = exec->codeBlock();
810         dataLog("Throwing exception in call frame ", RawPointer(exec), " for code block ", codeBlock, "\n");
811         CRASH();
812     }
813
814     ASSERT(exec == topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec());
815
816     interpreter->notifyDebuggerOfExceptionToBeThrown(*this, exec, exception);
817
818     setException(exception);
819
820 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
821     m_nativeStackTraceOfLastThrow = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
822     m_throwingThread = &Thread::current();
823 #endif
824 }
825
826 JSValue VM::throwException(ExecState* exec, JSValue thrownValue)
827 {
828     VM& vm = *this;
829     Exception* exception = jsDynamicCast<Exception*>(vm, thrownValue);
830     if (!exception)
831         exception = Exception::create(*this, thrownValue);
832
833     throwException(exec, exception);
834     return JSValue(exception);
835 }
836
837 JSObject* VM::throwException(ExecState* exec, JSObject* error)
838 {
839     return asObject(throwException(exec, JSValue(error)));
840 }
841
842 void VM::setStackPointerAtVMEntry(void* sp)
843 {
844     m_stackPointerAtVMEntry = sp;
845     updateStackLimits();
846 }
847
848 size_t VM::updateSoftReservedZoneSize(size_t softReservedZoneSize)
849 {
850     size_t oldSoftReservedZoneSize = m_currentSoftReservedZoneSize;
851     m_currentSoftReservedZoneSize = softReservedZoneSize;
852 #if !ENABLE(JIT)
853     interpreter->cloopStack().setSoftReservedZoneSize(softReservedZoneSize);
854 #endif
855
856     updateStackLimits();
857
858     return oldSoftReservedZoneSize;
859 }
860
861 #if OS(WINDOWS)
862 // On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
863 // where the guard page is a barrier between committed and uncommitted memory.
864 // When data from the guard page is read or written, the guard page is moved, and memory is committed.
865 // This is how the system grows the stack.
866 // When using the C stack on Windows we need to precommit the needed stack space.
867 // Otherwise we might crash later if we access uncommitted stack memory.
868 // This can happen if we allocate stack space larger than the page guard size (4K).
869 // The system does not get the chance to move the guard page, and commit more memory,
870 // and we crash if uncommitted memory is accessed.
871 // The MSVC compiler fixes this by inserting a call to the _chkstk() function,
872 // when needed, see http://support.microsoft.com/kb/100775.
873 // By touching every page up to the stack limit with a dummy operation,
874 // we force the system to move the guard page, and commit memory.
875
876 static void preCommitStackMemory(void* stackLimit)
877 {
878     const int pageSize = 4096;
879     for (volatile char* p = reinterpret_cast<char*>(&stackLimit); p > stackLimit; p -= pageSize) {
880         char ch = *p;
881         *p = ch;
882     }
883 }
884 #endif
885
886 inline void VM::updateStackLimits()
887 {
888 #if OS(WINDOWS)
889     void* lastSoftStackLimit = m_softStackLimit;
890 #endif
891
892     const StackBounds& stack = Thread::current().stack();
893     size_t reservedZoneSize = Options::reservedZoneSize();
894     // We should have already ensured that Options::reservedZoneSize() >= minimumReserveZoneSize at
895     // options initialization time, and the option value should not have been changed thereafter.
896     // We don't have the ability to assert here that it hasn't changed, but we can at least assert
897     // that the value is sane.
898     RELEASE_ASSERT(reservedZoneSize >= minimumReservedZoneSize);
899
900     if (m_stackPointerAtVMEntry) {
901         ASSERT(stack.isGrowingDownward());
902         char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
903         m_softStackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), m_currentSoftReservedZoneSize);
904         m_stackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), reservedZoneSize);
905     } else {
906         m_softStackLimit = stack.recursionLimit(m_currentSoftReservedZoneSize);
907         m_stackLimit = stack.recursionLimit(reservedZoneSize);
908     }
909
910 #if OS(WINDOWS)
911     // We only need to precommit stack memory dictated by the VM::m_softStackLimit limit.
912     // This is because VM::m_softStackLimit applies to stack usage by LLINT asm or JIT
913     // generated code which can allocate stack space that the C++ compiler does not know
914     // about. As such, we have to precommit that stack memory manually.
915     //
916     // In contrast, we do not need to worry about VM::m_stackLimit because that limit is
917     // used exclusively by C++ code, and the C++ compiler will automatically commit the
918     // needed stack pages.
919     if (lastSoftStackLimit != m_softStackLimit)
920         preCommitStackMemory(m_softStackLimit);
921 #endif
922 }
923
924 #if ENABLE(DFG_JIT)
925 void VM::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
926 {
927     auto lock = holdLock(m_scratchBufferLock);
928     for (auto* scratchBuffer : m_scratchBuffers) {
929         if (scratchBuffer->activeLength()) {
930             void* bufferStart = scratchBuffer->dataBuffer();
931             conservativeRoots.add(bufferStart, static_cast<void*>(static_cast<char*>(bufferStart) + scratchBuffer->activeLength()));
932         }
933     }
934 }
935 #endif
936
937 void logSanitizeStack(VM* vm)
938 {
939     if (Options::verboseSanitizeStack() && vm->topCallFrame) {
940         int dummy;
941         auto& stackBounds = Thread::current().stack();
942         dataLog(
943             "Sanitizing stack for VM = ", RawPointer(vm), " with top call frame at ", RawPointer(vm->topCallFrame),
944             ", current stack pointer at ", RawPointer(&dummy), ", in ",
945             pointerDump(vm->topCallFrame->codeBlock()), ", last code origin = ",
946             vm->topCallFrame->codeOrigin(), ", last stack top = ", RawPointer(vm->lastStackTop()), ", in stack range [", RawPointer(stackBounds.origin()), ", ", RawPointer(stackBounds.end()), "]\n");
947     }
948 }
949
950 #if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
951 char* VM::acquireRegExpPatternContexBuffer()
952 {
953     m_regExpPatternContextLock.lock();
954     ASSERT(m_regExpPatternContextLock.isLocked());
955     if (!m_regExpPatternContexBuffer)
956         m_regExpPatternContexBuffer = makeUniqueArray<char>(VM::patternContextBufferSize);
957     return m_regExpPatternContexBuffer.get();
958 }
959
960 void VM::releaseRegExpPatternContexBuffer()
961 {
962     ASSERT(m_regExpPatternContextLock.isLocked());
963
964     m_regExpPatternContextLock.unlock();
965 }
966 #endif
967
968 #if ENABLE(REGEXP_TRACING)
969 void VM::addRegExpToTrace(RegExp* regExp)
970 {
971     gcProtect(regExp);
972     m_rtTraceList->add(regExp);
973 }
974
975 void VM::dumpRegExpTrace()
976 {
977     // The first RegExp object is ignored.  It is create by the RegExpPrototype ctor and not used.
978     RTTraceList::iterator iter = ++m_rtTraceList->begin();
979     
980     if (iter != m_rtTraceList->end()) {
981         dataLogF("\nRegExp Tracing\n");
982         dataLogF("Regular Expression                              8 Bit          16 Bit        match()    Matches    Average\n");
983         dataLogF(" <Match only / Match>                         JIT Addr      JIT Address       calls      found   String len\n");
984         dataLogF("----------------------------------------+----------------+----------------+----------+----------+-----------\n");
985     
986         unsigned reCount = 0;
987     
988         for (; iter != m_rtTraceList->end(); ++iter, ++reCount) {
989             (*iter)->printTraceData();
990             gcUnprotect(*iter);
991         }
992
993         dataLogF("%d Regular Expressions\n", reCount);
994     }
995     
996     m_rtTraceList->clear();
997 }
998 #else
999 void VM::dumpRegExpTrace()
1000 {
1001 }
1002 #endif
1003
1004 WatchpointSet* VM::ensureWatchpointSetForImpureProperty(const Identifier& propertyName)
1005 {
1006     auto result = m_impurePropertyWatchpointSets.add(propertyName.string(), nullptr);
1007     if (result.isNewEntry)
1008         result.iterator->value = adoptRef(new WatchpointSet(IsWatched));
1009     return result.iterator->value.get();
1010 }
1011
1012 void VM::registerWatchpointForImpureProperty(const Identifier& propertyName, Watchpoint* watchpoint)
1013 {
1014     ensureWatchpointSetForImpureProperty(propertyName)->add(watchpoint);
1015 }
1016
1017 void VM::addImpureProperty(const String& propertyName)
1018 {
1019     if (RefPtr<WatchpointSet> watchpointSet = m_impurePropertyWatchpointSets.take(propertyName))
1020         watchpointSet->fireAll(*this, "Impure property added");
1021 }
1022
1023 static bool enableProfilerWithRespectToCount(unsigned& counter, std::function<void()> doEnableWork)
1024 {
1025     bool needsToRecompile = false;
1026     if (!counter) {
1027         doEnableWork();
1028         needsToRecompile = true;
1029     }
1030     counter++;
1031
1032     return needsToRecompile;
1033 }
1034
1035 static bool disableProfilerWithRespectToCount(unsigned& counter, std::function<void()> doDisableWork)
1036 {
1037     RELEASE_ASSERT(counter > 0);
1038     bool needsToRecompile = false;
1039     counter--;
1040     if (!counter) {
1041         doDisableWork();
1042         needsToRecompile = true;
1043     }
1044
1045     return needsToRecompile;
1046 }
1047
1048 bool VM::enableTypeProfiler()
1049 {
1050     auto enableTypeProfiler = [this] () {
1051         this->m_typeProfiler = std::make_unique<TypeProfiler>();
1052         this->m_typeProfilerLog = std::make_unique<TypeProfilerLog>(*this);
1053     };
1054
1055     return enableProfilerWithRespectToCount(m_typeProfilerEnabledCount, enableTypeProfiler);
1056 }
1057
1058 bool VM::disableTypeProfiler()
1059 {
1060     auto disableTypeProfiler = [this] () {
1061         this->m_typeProfiler.reset(nullptr);
1062         this->m_typeProfilerLog.reset(nullptr);
1063     };
1064
1065     return disableProfilerWithRespectToCount(m_typeProfilerEnabledCount, disableTypeProfiler);
1066 }
1067
1068 bool VM::enableControlFlowProfiler()
1069 {
1070     auto enableControlFlowProfiler = [this] () {
1071         this->m_controlFlowProfiler = std::make_unique<ControlFlowProfiler>();
1072     };
1073
1074     return enableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, enableControlFlowProfiler);
1075 }
1076
1077 bool VM::disableControlFlowProfiler()
1078 {
1079     auto disableControlFlowProfiler = [this] () {
1080         this->m_controlFlowProfiler.reset(nullptr);
1081     };
1082
1083     return disableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, disableControlFlowProfiler);
1084 }
1085
1086 void VM::dumpTypeProfilerData()
1087 {
1088     if (!typeProfiler())
1089         return;
1090
1091     typeProfilerLog()->processLogEntries(ASCIILiteral("VM Dump Types"));
1092     typeProfiler()->dumpTypeProfilerData(*this);
1093 }
1094
1095 void VM::queueMicrotask(JSGlobalObject& globalObject, Ref<Microtask>&& task)
1096 {
1097     m_microtaskQueue.append(std::make_unique<QueuedTask>(*this, &globalObject, WTFMove(task)));
1098 }
1099
1100 void VM::drainMicrotasks()
1101 {
1102     while (!m_microtaskQueue.isEmpty())
1103         m_microtaskQueue.takeFirst()->run();
1104 }
1105
1106 void QueuedTask::run()
1107 {
1108     m_microtask->run(m_globalObject->globalExec());
1109 }
1110
1111 void sanitizeStackForVM(VM* vm)
1112 {
1113     logSanitizeStack(vm);
1114     if (vm->topCallFrame) {
1115         auto& stackBounds = Thread::current().stack();
1116         ASSERT(vm->currentThreadIsHoldingAPILock());
1117         ASSERT_UNUSED(stackBounds, stackBounds.contains(vm->lastStackTop()));
1118     }
1119 #if !ENABLE(JIT)
1120     vm->interpreter->cloopStack().sanitizeStack();
1121 #else
1122     sanitizeStackForVMImpl(vm);
1123 #endif
1124 }
1125
1126 size_t VM::committedStackByteCount()
1127 {
1128 #if ENABLE(JIT)
1129     // When using the C stack, we don't know how many stack pages are actually
1130     // committed. So, we use the current stack usage as an estimate.
1131     ASSERT(Thread::current().stack().isGrowingDownward());
1132     int8_t* current = reinterpret_cast<int8_t*>(&current);
1133     int8_t* high = reinterpret_cast<int8_t*>(Thread::current().stack().origin());
1134     return high - current;
1135 #else
1136     return CLoopStack::committedByteCount();
1137 #endif
1138 }
1139
1140 #if !ENABLE(JIT)
1141 bool VM::ensureStackCapacityForCLoop(Register* newTopOfStack)
1142 {
1143     return interpreter->cloopStack().ensureCapacityFor(newTopOfStack);
1144 }
1145
1146 bool VM::isSafeToRecurseSoftCLoop() const
1147 {
1148     return interpreter->cloopStack().isSafeToRecurse();
1149 }
1150 #endif // !ENABLE(JIT)
1151
1152 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
1153 void VM::verifyExceptionCheckNeedIsSatisfied(unsigned recursionDepth, ExceptionEventLocation& location)
1154 {
1155     if (!Options::validateExceptionChecks())
1156         return;
1157
1158     if (UNLIKELY(m_needExceptionCheck)) {
1159         auto throwDepth = m_simulatedThrowPointRecursionDepth;
1160         auto& throwLocation = m_simulatedThrowPointLocation;
1161
1162         dataLog(
1163             "ERROR: Unchecked JS exception:\n"
1164             "    This scope can throw a JS exception: ", throwLocation, "\n"
1165             "        (ExceptionScope::m_recursionDepth was ", throwDepth, ")\n"
1166             "    But the exception was unchecked as of this scope: ", location, "\n"
1167             "        (ExceptionScope::m_recursionDepth was ", recursionDepth, ")\n"
1168             "\n");
1169
1170         StringPrintStream out;
1171         std::unique_ptr<StackTrace> currentTrace = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
1172
1173         if (Options::dumpSimulatedThrows()) {
1174             out.println("The simulated exception was thrown at:");
1175             m_nativeStackTraceOfLastSimulatedThrow->dump(out, "    ");
1176             out.println();
1177         }
1178         out.println("Unchecked exception detected at:");
1179         currentTrace->dump(out, "    ");
1180         out.println();
1181
1182         dataLog(out.toCString());
1183         RELEASE_ASSERT(!m_needExceptionCheck);
1184     }
1185 }
1186 #endif
1187
1188 #if USE(CF)
1189 void VM::registerRunLoopTimer(JSRunLoopTimer* timer)
1190 {
1191     ASSERT(runLoop());
1192     ASSERT(!m_runLoopTimers.contains(timer));
1193     m_runLoopTimers.add(timer);
1194     timer->setRunLoop(runLoop());
1195 }
1196
1197 void VM::unregisterRunLoopTimer(JSRunLoopTimer* timer)
1198 {
1199     ASSERT(m_runLoopTimers.contains(timer));
1200     m_runLoopTimers.remove(timer);
1201     timer->setRunLoop(nullptr);
1202 }
1203
1204 void VM::setRunLoop(CFRunLoopRef runLoop)
1205 {
1206     ASSERT(runLoop);
1207     m_runLoop = runLoop;
1208     for (auto timer : m_runLoopTimers)
1209         timer->setRunLoop(runLoop);
1210 }
1211 #endif // USE(CF)
1212
1213 ScratchBuffer* VM::scratchBufferForSize(size_t size)
1214 {
1215     if (!size)
1216         return nullptr;
1217
1218     auto locker = holdLock(m_scratchBufferLock);
1219
1220     if (size > m_sizeOfLastScratchBuffer) {
1221         // Protect against a N^2 memory usage pathology by ensuring
1222         // that at worst, we get a geometric series, meaning that the
1223         // total memory usage is somewhere around
1224         // max(scratch buffer size) * 4.
1225         m_sizeOfLastScratchBuffer = size * 2;
1226
1227         ScratchBuffer* newBuffer = ScratchBuffer::create(m_sizeOfLastScratchBuffer);
1228         RELEASE_ASSERT(newBuffer);
1229         m_scratchBuffers.append(newBuffer);
1230     }
1231
1232     ScratchBuffer* result = m_scratchBuffers.last();
1233     return result;
1234 }
1235
1236 } // namespace JSC