JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary
[WebKit-https.git] / Source / JavaScriptCore / runtime / VM.cpp
1 /*
2  * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer. 
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution. 
13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission. 
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28
29 #include "config.h"
30 #include "VM.h"
31
32 #include "ArgList.h"
33 #include "ArrayBufferNeuteringWatchpoint.h"
34 #include "BuiltinExecutables.h"
35 #include "BytecodeIntrinsicRegistry.h"
36 #include "CodeBlock.h"
37 #include "CodeCache.h"
38 #include "CommonIdentifiers.h"
39 #include "CommonSlowPaths.h"
40 #include "CustomGetterSetter.h"
41 #include "DFGWorklist.h"
42 #include "DirectEvalExecutable.h"
43 #include "Disassembler.h"
44 #include "Error.h"
45 #include "ErrorConstructor.h"
46 #include "ErrorInstance.h"
47 #include "EvalCodeBlock.h"
48 #include "Exception.h"
49 #include "ExecutableToCodeBlockEdge.h"
50 #include "FTLThunks.h"
51 #include "FastMallocAlignedMemoryAllocator.h"
52 #include "FunctionCodeBlock.h"
53 #include "FunctionConstructor.h"
54 #include "FunctionExecutable.h"
55 #include "GCActivityCallback.h"
56 #include "GetterSetter.h"
57 #include "GigacageAlignedMemoryAllocator.h"
58 #include "HasOwnPropertyCache.h"
59 #include "Heap.h"
60 #include "HeapIterationScope.h"
61 #include "HeapProfiler.h"
62 #include "HostCallReturnValue.h"
63 #include "Identifier.h"
64 #include "IncrementalSweeper.h"
65 #include "IndirectEvalExecutable.h"
66 #include "InferredTypeTable.h"
67 #include "InferredValue.h"
68 #include "Interpreter.h"
69 #include "IntlCollatorConstructor.h"
70 #include "IntlDateTimeFormatConstructor.h"
71 #include "IntlNumberFormatConstructor.h"
72 #include "IntlPluralRulesConstructor.h"
73 #include "JITCode.h"
74 #include "JITWorklist.h"
75 #include "JSAPIValueWrapper.h"
76 #include "JSArray.h"
77 #include "JSArrayBufferConstructor.h"
78 #include "JSAsyncFunction.h"
79 #include "JSBigInt.h"
80 #include "JSBoundFunction.h"
81 #include "JSCInlines.h"
82 #include "JSCallbackFunction.h"
83 #include "JSCustomGetterSetterFunction.h"
84 #include "JSDestructibleObjectHeapCellType.h"
85 #include "JSFixedArray.h"
86 #include "JSFunction.h"
87 #include "JSGlobalObjectFunctions.h"
88 #include "JSImmutableButterfly.h"
89 #include "JSInternalPromiseDeferred.h"
90 #include "JSLock.h"
91 #include "JSMap.h"
92 #include "JSMapIterator.h"
93 #include "JSPromiseDeferred.h"
94 #include "JSPropertyNameEnumerator.h"
95 #include "JSSegmentedVariableObjectHeapCellType.h"
96 #include "JSScriptFetchParameters.h"
97 #include "JSScriptFetcher.h"
98 #include "JSSet.h"
99 #include "JSSetIterator.h"
100 #include "JSSourceCode.h"
101 #include "JSStringHeapCellType.h"
102 #include "JSTemplateObjectDescriptor.h"
103 #include "JSWeakMap.h"
104 #include "JSWeakSet.h"
105 #include "JSWebAssembly.h"
106 #include "JSWebAssemblyCodeBlock.h"
107 #include "JSWebAssemblyCodeBlockHeapCellType.h"
108 #include "JSWithScope.h"
109 #include "LLIntData.h"
110 #include "Lexer.h"
111 #include "Lookup.h"
112 #include "MinimumReservedZoneSize.h"
113 #include "ModuleProgramCodeBlock.h"
114 #include "ModuleProgramExecutable.h"
115 #include "NativeErrorConstructor.h"
116 #include "NativeExecutable.h"
117 #include "NativeStdFunctionCell.h"
118 #include "Nodes.h"
119 #include "ObjCCallbackFunction.h"
120 #include "Parser.h"
121 #include "ProfilerDatabase.h"
122 #include "ProgramCodeBlock.h"
123 #include "ProgramExecutable.h"
124 #include "PromiseDeferredTimer.h"
125 #include "PropertyMapHashTable.h"
126 #include "ProxyRevoke.h"
127 #include "RegExpCache.h"
128 #include "RegExpConstructor.h"
129 #include "RegExpObject.h"
130 #include "RegisterAtOffsetList.h"
131 #include "RuntimeType.h"
132 #include "SamplingProfiler.h"
133 #include "ShadowChicken.h"
134 #include "SimpleTypedArrayController.h"
135 #include "SourceProviderCache.h"
136 #include "StackVisitor.h"
137 #include "StrictEvalActivation.h"
138 #include "StrongInlines.h"
139 #include "StructureInlines.h"
140 #include "TestRunnerUtils.h"
141 #include "ThunkGenerators.h"
142 #include "TypeProfiler.h"
143 #include "TypeProfilerLog.h"
144 #include "UnlinkedCodeBlock.h"
145 #include "VMEntryScope.h"
146 #include "VMInspector.h"
147 #include "VariableEnvironment.h"
148 #include "WasmWorklist.h"
149 #include "Watchdog.h"
150 #include "WeakGCMapInlines.h"
151 #include "WebAssemblyFunction.h"
152 #include "WebAssemblyWrapperFunction.h"
153 #include <wtf/ProcessID.h>
154 #include <wtf/ReadWriteLock.h>
155 #include <wtf/SimpleStats.h>
156 #include <wtf/StringPrintStream.h>
157 #include <wtf/Threading.h>
158 #include <wtf/text/AtomicStringTable.h>
159 #include <wtf/text/SymbolRegistry.h>
160
161 #if !ENABLE(JIT)
162 #include "CLoopStack.h"
163 #include "CLoopStackInlines.h"
164 #endif
165
166 #if ENABLE(DFG_JIT)
167 #include "ConservativeRoots.h"
168 #endif
169
170 #if ENABLE(REGEXP_TRACING)
171 #include "RegExp.h"
172 #endif
173
174 using namespace WTF;
175
176 namespace JSC {
177
178 // Note: Platform.h will enforce that ENABLE(ASSEMBLER) is true if either
179 // ENABLE(JIT) or ENABLE(YARR_JIT) or both are enabled. The code below
180 // just checks for ENABLE(JIT) or ENABLE(YARR_JIT) with this premise in mind.
181
182 #if ENABLE(ASSEMBLER)
183 static bool enableAssembler(ExecutableAllocator& executableAllocator)
184 {
185     if (!Options::useJIT() && !Options::useRegExpJIT())
186         return false;
187
188     if (!executableAllocator.isValid()) {
189         if (Options::crashIfCantAllocateJITMemory())
190             CRASH();
191         return false;
192     }
193
194     char* canUseJITString = getenv("JavaScriptCoreUseJIT");
195     return !canUseJITString || atoi(canUseJITString);
196 }
197 #endif // ENABLE(!ASSEMBLER)
198
199 bool VM::canUseAssembler()
200 {
201 #if ENABLE(ASSEMBLER)
202     static std::once_flag onceKey;
203     static bool enabled = false;
204     std::call_once(onceKey, [] {
205         enabled = enableAssembler(ExecutableAllocator::singleton());
206     });
207     return enabled;
208 #else
209     return false; // interpreter only
210 #endif
211 }
212
213 bool VM::canUseJIT()
214 {
215 #if ENABLE(JIT)
216     static std::once_flag onceKey;
217     static bool enabled = false;
218     std::call_once(onceKey, [] {
219         enabled = VM::canUseAssembler() && Options::useJIT();
220     });
221     return enabled;
222 #else
223     return false; // interpreter only
224 #endif
225 }
226
227 bool VM::canUseRegExpJIT()
228 {
229 #if ENABLE(YARR_JIT)
230     static std::once_flag onceKey;
231     static bool enabled = false;
232     std::call_once(onceKey, [] {
233         enabled = VM::canUseAssembler() && Options::useRegExpJIT();
234     });
235     return enabled;
236 #else
237     return false; // interpreter only
238 #endif
239 }
240
241 bool VM::isInMiniMode()
242 {
243     return !canUseJIT() || Options::forceMiniVMMode();
244 }
245
246 VM::VM(VMType vmType, HeapType heapType)
247     : m_apiLock(adoptRef(new JSLock(this)))
248 #if USE(CF)
249     , m_runLoop(CFRunLoopGetCurrent())
250 #endif // USE(CF)
251     , heap(this, heapType)
252     , fastMallocAllocator(std::make_unique<FastMallocAlignedMemoryAllocator>())
253     , primitiveGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::Primitive))
254     , jsValueGigacageAllocator(std::make_unique<GigacageAlignedMemoryAllocator>(Gigacage::JSValue))
255     , auxiliaryHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::Auxiliary)))
256     , cellJSValueOOBHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
257     , immutableButterflyHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCellWithInteriorPointers)))
258     , cellDangerousBitsHeapCellType(std::make_unique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
259     , destructibleCellHeapCellType(std::make_unique<HeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)))
260     , stringHeapCellType(std::make_unique<JSStringHeapCellType>())
261     , destructibleObjectHeapCellType(std::make_unique<JSDestructibleObjectHeapCellType>())
262     , segmentedVariableObjectHeapCellType(std::make_unique<JSSegmentedVariableObjectHeapCellType>())
263 #if ENABLE(WEBASSEMBLY)
264     , webAssemblyCodeBlockHeapCellType(std::make_unique<JSWebAssemblyCodeBlockHeapCellType>())
265 #endif
266     , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get())
267     , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get())
268     , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get())
269     , cellJSValueOOBSpace("JSCell JSValueOOB", heap, cellJSValueOOBHeapCellType.get(), fastMallocAllocator.get())
270     , cellDangerousBitsSpace("JSCell DangerousBits", heap, cellDangerousBitsHeapCellType.get(), fastMallocAllocator.get())
271     , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellJSValueOOBHeapCellType.get(), jsValueGigacageAllocator.get())
272     , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get())
273     , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get())
274     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
275     , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
276     , segmentedVariableObjectSpace("JSSegmentedVariableObjectSpace", heap, segmentedVariableObjectHeapCellType.get(), fastMallocAllocator.get())
277     , arrayBufferConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSArrayBufferConstructor)
278     , asyncFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncFunction)
279     , asyncGeneratorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncGeneratorFunction)
280     , boundFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSBoundFunction)
281     , callbackFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSCallbackFunction)
282     , customGetterSetterFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSCustomGetterSetterFunction)
283     , errorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ErrorConstructor)
284     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellDangerousBitsHeapCellType.get(), ExecutableToCodeBlockEdge)
285     , functionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSFunction)
286     , generatorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSGeneratorFunction)
287     , inferredTypeSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredType)
288     , inferredValueSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredValue)
289     , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
290 #if ENABLE(INTL)
291     , intlCollatorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlCollatorConstructor)
292     , intlDateTimeFormatConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlDateTimeFormatConstructor)
293     , intlNumberFormatConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlNumberFormatConstructor)
294     , intlPluralRulesConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), IntlPluralRulesConstructor)
295 #endif
296     , nativeErrorConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), NativeErrorConstructor)
297     , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable)
298     , nativeStdFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSNativeStdFunction)
299 #if JSC_OBJC_API_ENABLED
300     , objCCallbackFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ObjCCallbackFunction)
301 #endif
302     , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable)
303     , proxyRevokeSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ProxyRevoke)
304     , regExpConstructorSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), RegExpConstructor)
305     , strictModeTypeErrorFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), StrictModeTypeErrorFunction)
306     , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData)
307     , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure)
308     , weakSetSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakSet)
309     , weakMapSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakMap)
310     , errorInstanceSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ErrorInstance)
311 #if ENABLE(WEBASSEMBLY)
312     , webAssemblyCodeBlockSpace ISO_SUBSPACE_INIT(heap, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock)
313     , webAssemblyFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyFunction)
314     , webAssemblyWrapperFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyWrapperFunction)
315 #endif
316     , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
317     , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
318     , inferredTypesWithFinalizers(inferredTypeSpace)
319     , inferredValuesWithFinalizers(inferredValueSpace)
320     , evalCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), EvalCodeBlock)
321     , functionCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionCodeBlock)
322     , moduleProgramCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramCodeBlock)
323     , programCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramCodeBlock)
324     , directEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), DirectEvalExecutable)
325     , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
326     , indirectEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), IndirectEvalExecutable)
327     , moduleProgramExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramExecutable)
328     , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable)
329     , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable)
330     , vmType(vmType)
331     , clientData(0)
332     , topEntryFrame(nullptr)
333     , topCallFrame(CallFrame::noCaller())
334     , promiseDeferredTimer(std::make_unique<PromiseDeferredTimer>(*this))
335     , m_atomicStringTable(vmType == Default ? Thread::current().atomicStringTable() : new AtomicStringTable)
336     , propertyNames(nullptr)
337     , emptyList(new ArgList)
338     , machineCodeBytesPerBytecodeWordForBaselineJIT(std::make_unique<SimpleStats>())
339     , customGetterSetterFunctionMap(*this)
340     , stringCache(*this)
341     , symbolImplToSymbolMap(*this)
342     , structureCache(*this)
343     , interpreter(0)
344     , entryScope(0)
345     , m_regExpCache(new RegExpCache(this))
346     , m_compactVariableMap(adoptRef(*(new CompactVariableMap)))
347 #if ENABLE(REGEXP_TRACING)
348     , m_rtTraceList(new RTTraceList())
349 #endif
350 #if ENABLE(GC_VALIDATION)
351     , m_initializingObjectClass(0)
352 #endif
353     , m_stackPointerAtVMEntry(0)
354     , m_codeCache(std::make_unique<CodeCache>())
355     , m_builtinExecutables(std::make_unique<BuiltinExecutables>(*this))
356     , m_typeProfilerEnabledCount(0)
357     , m_primitiveGigacageEnabled(IsWatched)
358     , m_controlFlowProfilerEnabledCount(0)
359     , m_shadowChicken(std::make_unique<ShadowChicken>())
360 {
361     interpreter = new Interpreter(*this);
362     StackBounds stack = Thread::current().stack();
363     updateSoftReservedZoneSize(Options::softReservedZoneSize());
364     setLastStackTop(stack.origin());
365
366     // Need to be careful to keep everything consistent here
367     JSLockHolder lock(this);
368     AtomicStringTable* existingEntryAtomicStringTable = Thread::current().setCurrentAtomicStringTable(m_atomicStringTable);
369     propertyNames = new CommonIdentifiers(this);
370     structureStructure.set(*this, Structure::createStructure(*this));
371     structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
372     terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
373     stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
374     propertyNameEnumeratorStructure.set(*this, JSPropertyNameEnumerator::createStructure(*this, 0, jsNull()));
375     customGetterSetterStructure.set(*this, CustomGetterSetter::createStructure(*this, 0, jsNull()));
376     domAttributeGetterSetterStructure.set(*this, DOMAttributeGetterSetter::createStructure(*this, 0, jsNull()));
377     scopedArgumentsTableStructure.set(*this, ScopedArgumentsTable::createStructure(*this, 0, jsNull()));
378     apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, 0, jsNull()));
379     nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, 0, jsNull()));
380     evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, 0, jsNull()));
381     programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, 0, jsNull()));
382     functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, 0, jsNull()));
383 #if ENABLE(WEBASSEMBLY)
384     webAssemblyCodeBlockStructure.set(*this, JSWebAssemblyCodeBlock::createStructure(*this, 0, jsNull()));
385 #endif
386     moduleProgramExecutableStructure.set(*this, ModuleProgramExecutable::createStructure(*this, 0, jsNull()));
387     regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
388     symbolStructure.set(*this, Symbol::createStructure(*this, 0, jsNull()));
389     symbolTableStructure.set(*this, SymbolTable::createStructure(*this, 0, jsNull()));
390     fixedArrayStructure.set(*this, JSFixedArray::createStructure(*this, 0, jsNull()));
391
392     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithInt32) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithInt32));
393     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithDouble) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithDouble));
394     immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithContiguous) - NumberOfIndexingShapes].set(*this, JSImmutableButterfly::createStructure(*this, 0, jsNull(), CopyOnWriteArrayWithContiguous));
395
396     sourceCodeStructure.set(*this, JSSourceCode::createStructure(*this, 0, jsNull()));
397     scriptFetcherStructure.set(*this, JSScriptFetcher::createStructure(*this, 0, jsNull()));
398     scriptFetchParametersStructure.set(*this, JSScriptFetchParameters::createStructure(*this, 0, jsNull()));
399     structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
400     sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
401     templateObjectDescriptorStructure.set(*this, JSTemplateObjectDescriptor::createStructure(*this, 0, jsNull()));
402     arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpoint::createStructure(*this));
403     unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
404     unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
405     unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
406     unlinkedFunctionCodeBlockStructure.set(*this, UnlinkedFunctionCodeBlock::createStructure(*this, 0, jsNull()));
407     unlinkedModuleProgramCodeBlockStructure.set(*this, UnlinkedModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
408     propertyTableStructure.set(*this, PropertyTable::createStructure(*this, 0, jsNull()));
409     inferredTypeStructure.set(*this, InferredType::createStructure(*this, 0, jsNull()));
410     inferredTypeTableStructure.set(*this, InferredTypeTable::createStructure(*this, 0, jsNull()));
411     inferredValueStructure.set(*this, InferredValue::createStructure(*this, 0, jsNull()));
412     functionRareDataStructure.set(*this, FunctionRareData::createStructure(*this, 0, jsNull()));
413     exceptionStructure.set(*this, Exception::createStructure(*this, 0, jsNull()));
414     promiseDeferredStructure.set(*this, JSPromiseDeferred::createStructure(*this, 0, jsNull()));
415     internalPromiseDeferredStructure.set(*this, JSInternalPromiseDeferred::createStructure(*this, 0, jsNull()));
416     programCodeBlockStructure.set(*this, ProgramCodeBlock::createStructure(*this, 0, jsNull()));
417     moduleProgramCodeBlockStructure.set(*this, ModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
418     evalCodeBlockStructure.set(*this, EvalCodeBlock::createStructure(*this, 0, jsNull()));
419     functionCodeBlockStructure.set(*this, FunctionCodeBlock::createStructure(*this, 0, jsNull()));
420     hashMapBucketSetStructure.set(*this, HashMapBucket<HashMapBucketDataKey>::createStructure(*this, 0, jsNull()));
421     hashMapBucketMapStructure.set(*this, HashMapBucket<HashMapBucketDataKeyValue>::createStructure(*this, 0, jsNull()));
422     setIteratorStructure.set(*this, JSSetIterator::createStructure(*this, 0, jsNull()));
423     mapIteratorStructure.set(*this, JSMapIterator::createStructure(*this, 0, jsNull()));
424     bigIntStructure.set(*this, JSBigInt::createStructure(*this, 0, jsNull()));
425     executableToCodeBlockEdgeStructure.set(*this, ExecutableToCodeBlockEdge::createStructure(*this, nullptr, jsNull()));
426
427     sentinelSetBucket.set(*this, JSSet::BucketType::createSentinel(*this));
428     sentinelMapBucket.set(*this, JSMap::BucketType::createSentinel(*this));
429
430     nativeStdFunctionCellStructure.set(*this, NativeStdFunctionCell::createStructure(*this, 0, jsNull()));
431     smallStrings.initializeCommonStrings(*this);
432
433     Thread::current().setCurrentAtomicStringTable(existingEntryAtomicStringTable);
434
435 #if ENABLE(JIT)
436     jitStubs = std::make_unique<JITThunks>();
437 #endif
438
439 #if ENABLE(FTL_JIT)
440     ftlThunks = std::make_unique<FTL::Thunks>();
441 #endif // ENABLE(FTL_JIT)
442     
443 #if ENABLE(JIT)
444     initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
445 #endif
446     
447     Gigacage::addPrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
448
449     heap.notifyIsSafeToCollect();
450     
451     LLInt::Data::performAssertions(*this);
452     
453     if (UNLIKELY(Options::useProfiler())) {
454         m_perBytecodeProfiler = std::make_unique<Profiler::Database>(*this);
455
456         StringPrintStream pathOut;
457         const char* profilerPath = getenv("JSC_PROFILER_PATH");
458         if (profilerPath)
459             pathOut.print(profilerPath, "/");
460         pathOut.print("JSCProfile-", getCurrentProcessID(), "-", m_perBytecodeProfiler->databaseID(), ".json");
461         m_perBytecodeProfiler->registerToSaveAtExit(pathOut.toCString().data());
462     }
463
464     callFrameForCatch = nullptr;
465
466     // Initialize this last, as a free way of asserting that VM initialization itself
467     // won't use this.
468     m_typedArrayController = adoptRef(new SimpleTypedArrayController());
469
470     m_bytecodeIntrinsicRegistry = std::make_unique<BytecodeIntrinsicRegistry>(*this);
471
472     if (Options::useTypeProfiler())
473         enableTypeProfiler();
474     if (Options::useControlFlowProfiler())
475         enableControlFlowProfiler();
476 #if ENABLE(SAMPLING_PROFILER)
477     if (Options::useSamplingProfiler()) {
478         setShouldBuildPCToCodeOriginMapping();
479         Ref<Stopwatch> stopwatch = Stopwatch::create();
480         stopwatch->start();
481         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
482         if (Options::samplingProfilerPath())
483             m_samplingProfiler->registerForReportAtExit();
484         m_samplingProfiler->start();
485     }
486 #endif // ENABLE(SAMPLING_PROFILER)
487
488     if (Options::alwaysGeneratePCToCodeOriginMap())
489         setShouldBuildPCToCodeOriginMapping();
490
491     if (Options::watchdog()) {
492         Watchdog& watchdog = ensureWatchdog();
493         watchdog.setTimeLimit(Seconds::fromMilliseconds(Options::watchdog()));
494     }
495
496 #if ENABLE(JIT)
497     // Make sure that any stubs that the JIT is going to use are initialized in non-compilation threads.
498     if (canUseJIT()) {
499         getCTIInternalFunctionTrampolineFor(CodeForCall);
500         getCTIInternalFunctionTrampolineFor(CodeForConstruct);
501     }
502 #endif
503
504     if (!canUseJIT())
505         noJITValueProfileSingleton = std::make_unique<ValueProfile>(0);
506
507     VMInspector::instance().add(this);
508 }
509
510 static ReadWriteLock s_destructionLock;
511
512 void waitForVMDestruction()
513 {
514     auto locker = holdLock(s_destructionLock.write());
515 }
516
517 VM::~VM()
518 {
519     auto destructionLocker = holdLock(s_destructionLock.read());
520     
521     Gigacage::removePrimitiveDisableCallback(primitiveGigacageDisabledCallback, this);
522     promiseDeferredTimer->stopRunningTasks();
523 #if ENABLE(WEBASSEMBLY)
524     if (Wasm::existingWorklistOrNull())
525         Wasm::ensureWorklist().stopAllPlansForContext(wasmContext);
526 #endif
527     if (UNLIKELY(m_watchdog))
528         m_watchdog->willDestroyVM(this);
529     m_traps.willDestroyVM();
530     VMInspector::instance().remove(this);
531
532     // Never GC, ever again.
533     heap.incrementDeferralDepth();
534
535 #if ENABLE(SAMPLING_PROFILER)
536     if (m_samplingProfiler) {
537         m_samplingProfiler->reportDataToOptionFile();
538         m_samplingProfiler->shutdown();
539     }
540 #endif // ENABLE(SAMPLING_PROFILER)
541     
542 #if ENABLE(JIT)
543     JITWorklist::instance()->completeAllForVM(*this);
544 #endif // ENABLE(JIT)
545
546 #if ENABLE(DFG_JIT)
547     // Make sure concurrent compilations are done, but don't install them, since there is
548     // no point to doing so.
549     for (unsigned i = DFG::numberOfWorklists(); i--;) {
550         if (DFG::Worklist* worklist = DFG::existingWorklistForIndexOrNull(i)) {
551             worklist->removeNonCompilingPlansForVM(*this);
552             worklist->waitUntilAllPlansForVMAreReady(*this);
553             worklist->removeAllReadyPlansForVM(*this);
554         }
555     }
556 #endif // ENABLE(DFG_JIT)
557     
558     waitForAsynchronousDisassembly();
559     
560     // Clear this first to ensure that nobody tries to remove themselves from it.
561     m_perBytecodeProfiler = nullptr;
562
563     ASSERT(currentThreadIsHoldingAPILock());
564     m_apiLock->willDestroyVM(this);
565     heap.lastChanceToFinalize();
566     
567     delete interpreter;
568 #ifndef NDEBUG
569     interpreter = reinterpret_cast<Interpreter*>(0xbbadbeef);
570 #endif
571
572     delete emptyList;
573
574     delete propertyNames;
575     if (vmType != Default)
576         delete m_atomicStringTable;
577
578     delete clientData;
579     delete m_regExpCache;
580
581 #if ENABLE(REGEXP_TRACING)
582     delete m_rtTraceList;
583 #endif
584
585 #if ENABLE(DFG_JIT)
586     for (unsigned i = 0; i < m_scratchBuffers.size(); ++i)
587         fastFree(m_scratchBuffers[i]);
588 #endif
589 }
590
591 void VM::primitiveGigacageDisabledCallback(void* argument)
592 {
593     static_cast<VM*>(argument)->primitiveGigacageDisabled();
594 }
595
596 void VM::primitiveGigacageDisabled()
597 {
598     if (m_apiLock->currentThreadIsHoldingLock()) {
599         m_primitiveGigacageEnabled.fireAll(*this, "Primitive gigacage disabled");
600         return;
601     }
602  
603     // This is totally racy, and that's OK. The point is, it's up to the user to ensure that they pass the
604     // uncaged buffer in a nicely synchronized manner.
605     m_needToFirePrimitiveGigacageEnabled = true;
606 }
607
608 void VM::setLastStackTop(void* lastStackTop)
609
610     m_lastStackTop = lastStackTop;
611 }
612
613 Ref<VM> VM::createContextGroup(HeapType heapType)
614 {
615     return adoptRef(*new VM(APIContextGroup, heapType));
616 }
617
618 Ref<VM> VM::create(HeapType heapType)
619 {
620     return adoptRef(*new VM(Default, heapType));
621 }
622
623 bool VM::sharedInstanceExists()
624 {
625     return sharedInstanceInternal();
626 }
627
628 VM& VM::sharedInstance()
629 {
630     GlobalJSLock globalLock;
631     VM*& instance = sharedInstanceInternal();
632     if (!instance)
633         instance = adoptRef(new VM(APIShared, SmallHeap)).leakRef();
634     return *instance;
635 }
636
637 VM*& VM::sharedInstanceInternal()
638 {
639     static VM* sharedInstance;
640     return sharedInstance;
641 }
642
643 Watchdog& VM::ensureWatchdog()
644 {
645     if (!m_watchdog)
646         m_watchdog = adoptRef(new Watchdog(this));
647     return *m_watchdog;
648 }
649
650 HeapProfiler& VM::ensureHeapProfiler()
651 {
652     if (!m_heapProfiler)
653         m_heapProfiler = std::make_unique<HeapProfiler>(*this);
654     return *m_heapProfiler;
655 }
656
657 #if ENABLE(SAMPLING_PROFILER)
658 SamplingProfiler& VM::ensureSamplingProfiler(RefPtr<Stopwatch>&& stopwatch)
659 {
660     if (!m_samplingProfiler)
661         m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
662     return *m_samplingProfiler;
663 }
664 #endif // ENABLE(SAMPLING_PROFILER)
665
666 #if ENABLE(JIT)
667 static ThunkGenerator thunkGeneratorForIntrinsic(Intrinsic intrinsic)
668 {
669     switch (intrinsic) {
670     case CharCodeAtIntrinsic:
671         return charCodeAtThunkGenerator;
672     case CharAtIntrinsic:
673         return charAtThunkGenerator;
674     case Clz32Intrinsic:
675         return clz32ThunkGenerator;
676     case FromCharCodeIntrinsic:
677         return fromCharCodeThunkGenerator;
678     case SqrtIntrinsic:
679         return sqrtThunkGenerator;
680     case AbsIntrinsic:
681         return absThunkGenerator;
682     case FloorIntrinsic:
683         return floorThunkGenerator;
684     case CeilIntrinsic:
685         return ceilThunkGenerator;
686     case TruncIntrinsic:
687         return truncThunkGenerator;
688     case RoundIntrinsic:
689         return roundThunkGenerator;
690     case ExpIntrinsic:
691         return expThunkGenerator;
692     case LogIntrinsic:
693         return logThunkGenerator;
694     case IMulIntrinsic:
695         return imulThunkGenerator;
696     case RandomIntrinsic:
697         return randomThunkGenerator;
698     case BoundThisNoArgsFunctionCallIntrinsic:
699         return boundThisNoArgsFunctionCallGenerator;
700     default:
701         return nullptr;
702     }
703 }
704
705 #endif // ENABLE(JIT)
706
707 NativeExecutable* VM::getHostFunction(NativeFunction function, NativeFunction constructor, const String& name)
708 {
709     return getHostFunction(function, NoIntrinsic, constructor, nullptr, name);
710 }
711
712 NativeExecutable* VM::getHostFunction(NativeFunction function, Intrinsic intrinsic, NativeFunction constructor, const DOMJIT::Signature* signature, const String& name)
713 {
714 #if ENABLE(JIT)
715     if (canUseJIT()) {
716         return jitStubs->hostFunctionStub(
717             this, function, constructor,
718             intrinsic != NoIntrinsic ? thunkGeneratorForIntrinsic(intrinsic) : 0,
719             intrinsic, signature, name);
720     }
721 #else // ENABLE(JIT)
722     UNUSED_PARAM(intrinsic);
723 #endif // ENABLE(JIT)
724     return NativeExecutable::create(*this,
725         adoptRef(*new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_call_trampoline), JITCode::HostCallThunk)), function,
726         adoptRef(*new NativeJITCode(LLInt::getCodeRef<JSEntryPtrTag>(llint_native_construct_trampoline), JITCode::HostCallThunk)), constructor,
727         NoIntrinsic, signature, name);
728 }
729
730 MacroAssemblerCodePtr<JSEntryPtrTag> VM::getCTIInternalFunctionTrampolineFor(CodeSpecializationKind kind)
731 {
732 #if ENABLE(JIT)
733     if (canUseJIT()) {
734         if (kind == CodeForCall)
735             return jitStubs->ctiInternalFunctionCall(this).retagged<JSEntryPtrTag>();
736         return jitStubs->ctiInternalFunctionConstruct(this).retagged<JSEntryPtrTag>();
737     }
738 #endif
739     if (kind == CodeForCall)
740         return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_call_trampoline);
741     return LLInt::getCodePtr<JSEntryPtrTag>(llint_internal_function_construct_trampoline);
742 }
743
744 VM::ClientData::~ClientData()
745 {
746 }
747
748 void VM::resetDateCache()
749 {
750     localTimeOffsetCache.reset();
751     cachedDateString = String();
752     cachedDateStringValue = std::numeric_limits<double>::quiet_NaN();
753     dateInstanceCache.reset();
754 }
755
756 void VM::whenIdle(std::function<void()> callback)
757 {
758     if (!entryScope) {
759         callback();
760         return;
761     }
762
763     entryScope->addDidPopListener(callback);
764 }
765
766 void VM::deleteAllLinkedCode(DeleteAllCodeEffort effort)
767 {
768     whenIdle([=] () {
769         heap.deleteAllCodeBlocks(effort);
770     });
771 }
772
773 void VM::deleteAllCode(DeleteAllCodeEffort effort)
774 {
775     whenIdle([=] () {
776         m_codeCache->clear();
777         m_regExpCache->deleteAllCode();
778         heap.deleteAllCodeBlocks(effort);
779         heap.deleteAllUnlinkedCodeBlocks(effort);
780         heap.reportAbandonedObjectGraph();
781     });
782 }
783
784 void VM::shrinkFootprintWhenIdle()
785 {
786     whenIdle([=] () {
787         sanitizeStackForVM(this);
788         deleteAllCode(DeleteAllCodeIfNotCollecting);
789         heap.collectNow(Synchronousness::Sync, CollectionScope::Full);
790         // FIXME: Consider stopping various automatic threads here.
791         // https://bugs.webkit.org/show_bug.cgi?id=185447
792         WTF::releaseFastMallocFreeMemory();
793     });
794 }
795
796 SourceProviderCache* VM::addSourceProviderCache(SourceProvider* sourceProvider)
797 {
798     auto addResult = sourceProviderCacheMap.add(sourceProvider, nullptr);
799     if (addResult.isNewEntry)
800         addResult.iterator->value = adoptRef(new SourceProviderCache);
801     return addResult.iterator->value.get();
802 }
803
804 void VM::clearSourceProviderCaches()
805 {
806     sourceProviderCacheMap.clear();
807 }
808
809 void VM::throwException(ExecState* exec, Exception* exception)
810 {
811     if (Options::breakOnThrow()) {
812         CodeBlock* codeBlock = exec->codeBlock();
813         dataLog("Throwing exception in call frame ", RawPointer(exec), " for code block ", codeBlock, "\n");
814         CRASH();
815     }
816
817     ASSERT(exec == topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec());
818
819     interpreter->notifyDebuggerOfExceptionToBeThrown(*this, exec, exception);
820
821     setException(exception);
822
823 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
824     m_nativeStackTraceOfLastThrow = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
825     m_throwingThread = &Thread::current();
826 #endif
827 }
828
829 JSValue VM::throwException(ExecState* exec, JSValue thrownValue)
830 {
831     VM& vm = *this;
832     Exception* exception = jsDynamicCast<Exception*>(vm, thrownValue);
833     if (!exception)
834         exception = Exception::create(*this, thrownValue);
835
836     throwException(exec, exception);
837     return JSValue(exception);
838 }
839
840 JSObject* VM::throwException(ExecState* exec, JSObject* error)
841 {
842     return asObject(throwException(exec, JSValue(error)));
843 }
844
845 void VM::setStackPointerAtVMEntry(void* sp)
846 {
847     m_stackPointerAtVMEntry = sp;
848     updateStackLimits();
849 }
850
851 size_t VM::updateSoftReservedZoneSize(size_t softReservedZoneSize)
852 {
853     size_t oldSoftReservedZoneSize = m_currentSoftReservedZoneSize;
854     m_currentSoftReservedZoneSize = softReservedZoneSize;
855 #if !ENABLE(JIT)
856     interpreter->cloopStack().setSoftReservedZoneSize(softReservedZoneSize);
857 #endif
858
859     updateStackLimits();
860
861     return oldSoftReservedZoneSize;
862 }
863
864 #if OS(WINDOWS)
865 // On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
866 // where the guard page is a barrier between committed and uncommitted memory.
867 // When data from the guard page is read or written, the guard page is moved, and memory is committed.
868 // This is how the system grows the stack.
869 // When using the C stack on Windows we need to precommit the needed stack space.
870 // Otherwise we might crash later if we access uncommitted stack memory.
871 // This can happen if we allocate stack space larger than the page guard size (4K).
872 // The system does not get the chance to move the guard page, and commit more memory,
873 // and we crash if uncommitted memory is accessed.
874 // The MSVC compiler fixes this by inserting a call to the _chkstk() function,
875 // when needed, see http://support.microsoft.com/kb/100775.
876 // By touching every page up to the stack limit with a dummy operation,
877 // we force the system to move the guard page, and commit memory.
878
879 static void preCommitStackMemory(void* stackLimit)
880 {
881     const int pageSize = 4096;
882     for (volatile char* p = reinterpret_cast<char*>(&stackLimit); p > stackLimit; p -= pageSize) {
883         char ch = *p;
884         *p = ch;
885     }
886 }
887 #endif
888
889 inline void VM::updateStackLimits()
890 {
891 #if OS(WINDOWS)
892     void* lastSoftStackLimit = m_softStackLimit;
893 #endif
894
895     const StackBounds& stack = Thread::current().stack();
896     size_t reservedZoneSize = Options::reservedZoneSize();
897     // We should have already ensured that Options::reservedZoneSize() >= minimumReserveZoneSize at
898     // options initialization time, and the option value should not have been changed thereafter.
899     // We don't have the ability to assert here that it hasn't changed, but we can at least assert
900     // that the value is sane.
901     RELEASE_ASSERT(reservedZoneSize >= minimumReservedZoneSize);
902
903     if (m_stackPointerAtVMEntry) {
904         ASSERT(stack.isGrowingDownward());
905         char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
906         m_softStackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), m_currentSoftReservedZoneSize);
907         m_stackLimit = stack.recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), reservedZoneSize);
908     } else {
909         m_softStackLimit = stack.recursionLimit(m_currentSoftReservedZoneSize);
910         m_stackLimit = stack.recursionLimit(reservedZoneSize);
911     }
912
913 #if OS(WINDOWS)
914     // We only need to precommit stack memory dictated by the VM::m_softStackLimit limit.
915     // This is because VM::m_softStackLimit applies to stack usage by LLINT asm or JIT
916     // generated code which can allocate stack space that the C++ compiler does not know
917     // about. As such, we have to precommit that stack memory manually.
918     //
919     // In contrast, we do not need to worry about VM::m_stackLimit because that limit is
920     // used exclusively by C++ code, and the C++ compiler will automatically commit the
921     // needed stack pages.
922     if (lastSoftStackLimit != m_softStackLimit)
923         preCommitStackMemory(m_softStackLimit);
924 #endif
925 }
926
927 #if ENABLE(DFG_JIT)
928 void VM::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
929 {
930     auto lock = holdLock(m_scratchBufferLock);
931     for (auto* scratchBuffer : m_scratchBuffers) {
932         if (scratchBuffer->activeLength()) {
933             void* bufferStart = scratchBuffer->dataBuffer();
934             conservativeRoots.add(bufferStart, static_cast<void*>(static_cast<char*>(bufferStart) + scratchBuffer->activeLength()));
935         }
936     }
937 }
938 #endif
939
940 void logSanitizeStack(VM* vm)
941 {
942     if (Options::verboseSanitizeStack() && vm->topCallFrame) {
943         int dummy;
944         auto& stackBounds = Thread::current().stack();
945         dataLog(
946             "Sanitizing stack for VM = ", RawPointer(vm), " with top call frame at ", RawPointer(vm->topCallFrame),
947             ", current stack pointer at ", RawPointer(&dummy), ", in ",
948             pointerDump(vm->topCallFrame->codeBlock()), ", last code origin = ",
949             vm->topCallFrame->codeOrigin(), ", last stack top = ", RawPointer(vm->lastStackTop()), ", in stack range [", RawPointer(stackBounds.origin()), ", ", RawPointer(stackBounds.end()), "]\n");
950     }
951 }
952
953 #if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
954 char* VM::acquireRegExpPatternContexBuffer()
955 {
956     m_regExpPatternContextLock.lock();
957     ASSERT(m_regExpPatternContextLock.isLocked());
958     if (!m_regExpPatternContexBuffer)
959         m_regExpPatternContexBuffer = makeUniqueArray<char>(VM::patternContextBufferSize);
960     return m_regExpPatternContexBuffer.get();
961 }
962
963 void VM::releaseRegExpPatternContexBuffer()
964 {
965     ASSERT(m_regExpPatternContextLock.isLocked());
966
967     m_regExpPatternContextLock.unlock();
968 }
969 #endif
970
971 #if ENABLE(REGEXP_TRACING)
972 void VM::addRegExpToTrace(RegExp* regExp)
973 {
974     gcProtect(regExp);
975     m_rtTraceList->add(regExp);
976 }
977
978 void VM::dumpRegExpTrace()
979 {
980     // The first RegExp object is ignored.  It is create by the RegExpPrototype ctor and not used.
981     RTTraceList::iterator iter = ++m_rtTraceList->begin();
982     
983     if (iter != m_rtTraceList->end()) {
984         dataLogF("\nRegExp Tracing\n");
985         dataLogF("Regular Expression                              8 Bit          16 Bit        match()    Matches    Average\n");
986         dataLogF(" <Match only / Match>                         JIT Addr      JIT Address       calls      found   String len\n");
987         dataLogF("----------------------------------------+----------------+----------------+----------+----------+-----------\n");
988     
989         unsigned reCount = 0;
990     
991         for (; iter != m_rtTraceList->end(); ++iter, ++reCount) {
992             (*iter)->printTraceData();
993             gcUnprotect(*iter);
994         }
995
996         dataLogF("%d Regular Expressions\n", reCount);
997     }
998     
999     m_rtTraceList->clear();
1000 }
1001 #else
1002 void VM::dumpRegExpTrace()
1003 {
1004 }
1005 #endif
1006
1007 WatchpointSet* VM::ensureWatchpointSetForImpureProperty(const Identifier& propertyName)
1008 {
1009     auto result = m_impurePropertyWatchpointSets.add(propertyName.string(), nullptr);
1010     if (result.isNewEntry)
1011         result.iterator->value = adoptRef(new WatchpointSet(IsWatched));
1012     return result.iterator->value.get();
1013 }
1014
1015 void VM::registerWatchpointForImpureProperty(const Identifier& propertyName, Watchpoint* watchpoint)
1016 {
1017     ensureWatchpointSetForImpureProperty(propertyName)->add(watchpoint);
1018 }
1019
1020 void VM::addImpureProperty(const String& propertyName)
1021 {
1022     if (RefPtr<WatchpointSet> watchpointSet = m_impurePropertyWatchpointSets.take(propertyName))
1023         watchpointSet->fireAll(*this, "Impure property added");
1024 }
1025
1026 static bool enableProfilerWithRespectToCount(unsigned& counter, std::function<void()> doEnableWork)
1027 {
1028     bool needsToRecompile = false;
1029     if (!counter) {
1030         doEnableWork();
1031         needsToRecompile = true;
1032     }
1033     counter++;
1034
1035     return needsToRecompile;
1036 }
1037
1038 static bool disableProfilerWithRespectToCount(unsigned& counter, std::function<void()> doDisableWork)
1039 {
1040     RELEASE_ASSERT(counter > 0);
1041     bool needsToRecompile = false;
1042     counter--;
1043     if (!counter) {
1044         doDisableWork();
1045         needsToRecompile = true;
1046     }
1047
1048     return needsToRecompile;
1049 }
1050
1051 bool VM::enableTypeProfiler()
1052 {
1053     auto enableTypeProfiler = [this] () {
1054         this->m_typeProfiler = std::make_unique<TypeProfiler>();
1055         this->m_typeProfilerLog = std::make_unique<TypeProfilerLog>(*this);
1056     };
1057
1058     return enableProfilerWithRespectToCount(m_typeProfilerEnabledCount, enableTypeProfiler);
1059 }
1060
1061 bool VM::disableTypeProfiler()
1062 {
1063     auto disableTypeProfiler = [this] () {
1064         this->m_typeProfiler.reset(nullptr);
1065         this->m_typeProfilerLog.reset(nullptr);
1066     };
1067
1068     return disableProfilerWithRespectToCount(m_typeProfilerEnabledCount, disableTypeProfiler);
1069 }
1070
1071 bool VM::enableControlFlowProfiler()
1072 {
1073     auto enableControlFlowProfiler = [this] () {
1074         this->m_controlFlowProfiler = std::make_unique<ControlFlowProfiler>();
1075     };
1076
1077     return enableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, enableControlFlowProfiler);
1078 }
1079
1080 bool VM::disableControlFlowProfiler()
1081 {
1082     auto disableControlFlowProfiler = [this] () {
1083         this->m_controlFlowProfiler.reset(nullptr);
1084     };
1085
1086     return disableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, disableControlFlowProfiler);
1087 }
1088
1089 void VM::dumpTypeProfilerData()
1090 {
1091     if (!typeProfiler())
1092         return;
1093
1094     typeProfilerLog()->processLogEntries("VM Dump Types"_s);
1095     typeProfiler()->dumpTypeProfilerData(*this);
1096 }
1097
1098 void VM::queueMicrotask(JSGlobalObject& globalObject, Ref<Microtask>&& task)
1099 {
1100     m_microtaskQueue.append(std::make_unique<QueuedTask>(*this, &globalObject, WTFMove(task)));
1101 }
1102
1103 void VM::drainMicrotasks()
1104 {
1105     while (!m_microtaskQueue.isEmpty())
1106         m_microtaskQueue.takeFirst()->run();
1107 }
1108
1109 void QueuedTask::run()
1110 {
1111     m_microtask->run(m_globalObject->globalExec());
1112 }
1113
1114 void sanitizeStackForVM(VM* vm)
1115 {
1116     logSanitizeStack(vm);
1117     if (vm->topCallFrame) {
1118         auto& stackBounds = Thread::current().stack();
1119         ASSERT(vm->currentThreadIsHoldingAPILock());
1120         ASSERT_UNUSED(stackBounds, stackBounds.contains(vm->lastStackTop()));
1121     }
1122 #if !ENABLE(JIT)
1123     vm->interpreter->cloopStack().sanitizeStack();
1124 #else
1125     sanitizeStackForVMImpl(vm);
1126 #endif
1127 }
1128
1129 size_t VM::committedStackByteCount()
1130 {
1131 #if ENABLE(JIT)
1132     // When using the C stack, we don't know how many stack pages are actually
1133     // committed. So, we use the current stack usage as an estimate.
1134     ASSERT(Thread::current().stack().isGrowingDownward());
1135     int8_t* current = reinterpret_cast<int8_t*>(&current);
1136     int8_t* high = reinterpret_cast<int8_t*>(Thread::current().stack().origin());
1137     return high - current;
1138 #else
1139     return CLoopStack::committedByteCount();
1140 #endif
1141 }
1142
1143 #if !ENABLE(JIT)
1144 bool VM::ensureStackCapacityForCLoop(Register* newTopOfStack)
1145 {
1146     return interpreter->cloopStack().ensureCapacityFor(newTopOfStack);
1147 }
1148
1149 bool VM::isSafeToRecurseSoftCLoop() const
1150 {
1151     return interpreter->cloopStack().isSafeToRecurse();
1152 }
1153 #endif // !ENABLE(JIT)
1154
1155 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
1156 void VM::verifyExceptionCheckNeedIsSatisfied(unsigned recursionDepth, ExceptionEventLocation& location)
1157 {
1158     if (!Options::validateExceptionChecks())
1159         return;
1160
1161     if (UNLIKELY(m_needExceptionCheck)) {
1162         auto throwDepth = m_simulatedThrowPointRecursionDepth;
1163         auto& throwLocation = m_simulatedThrowPointLocation;
1164
1165         dataLog(
1166             "ERROR: Unchecked JS exception:\n"
1167             "    This scope can throw a JS exception: ", throwLocation, "\n"
1168             "        (ExceptionScope::m_recursionDepth was ", throwDepth, ")\n"
1169             "    But the exception was unchecked as of this scope: ", location, "\n"
1170             "        (ExceptionScope::m_recursionDepth was ", recursionDepth, ")\n"
1171             "\n");
1172
1173         StringPrintStream out;
1174         std::unique_ptr<StackTrace> currentTrace = StackTrace::captureStackTrace(Options::unexpectedExceptionStackTraceLimit());
1175
1176         if (Options::dumpSimulatedThrows()) {
1177             out.println("The simulated exception was thrown at:");
1178             m_nativeStackTraceOfLastSimulatedThrow->dump(out, "    ");
1179             out.println();
1180         }
1181         out.println("Unchecked exception detected at:");
1182         currentTrace->dump(out, "    ");
1183         out.println();
1184
1185         dataLog(out.toCString());
1186         RELEASE_ASSERT(!m_needExceptionCheck);
1187     }
1188 }
1189 #endif
1190
1191 #if USE(CF)
1192 void VM::registerRunLoopTimer(JSRunLoopTimer* timer)
1193 {
1194     ASSERT(runLoop());
1195     ASSERT(!m_runLoopTimers.contains(timer));
1196     m_runLoopTimers.add(timer);
1197     timer->setRunLoop(runLoop());
1198 }
1199
1200 void VM::unregisterRunLoopTimer(JSRunLoopTimer* timer)
1201 {
1202     ASSERT(m_runLoopTimers.contains(timer));
1203     m_runLoopTimers.remove(timer);
1204     timer->setRunLoop(nullptr);
1205 }
1206
1207 void VM::setRunLoop(CFRunLoopRef runLoop)
1208 {
1209     ASSERT(runLoop);
1210     m_runLoop = runLoop;
1211     for (auto timer : m_runLoopTimers)
1212         timer->setRunLoop(runLoop);
1213 }
1214 #endif // USE(CF)
1215
1216 ScratchBuffer* VM::scratchBufferForSize(size_t size)
1217 {
1218     if (!size)
1219         return nullptr;
1220
1221     auto locker = holdLock(m_scratchBufferLock);
1222
1223     if (size > m_sizeOfLastScratchBuffer) {
1224         // Protect against a N^2 memory usage pathology by ensuring
1225         // that at worst, we get a geometric series, meaning that the
1226         // total memory usage is somewhere around
1227         // max(scratch buffer size) * 4.
1228         m_sizeOfLastScratchBuffer = size * 2;
1229
1230         ScratchBuffer* newBuffer = ScratchBuffer::create(m_sizeOfLastScratchBuffer);
1231         RELEASE_ASSERT(newBuffer);
1232         m_scratchBuffers.append(newBuffer);
1233     }
1234
1235     ScratchBuffer* result = m_scratchBuffers.last();
1236     return result;
1237 }
1238
1239 void VM::clearScratchBuffers()
1240 {
1241     auto lock = holdLock(m_scratchBufferLock);
1242     for (auto* scratchBuffer : m_scratchBuffers)
1243         scratchBuffer->setActiveLength(0);
1244 }
1245
1246 } // namespace JSC