Teach Call ICs how to call Wasm
[WebKit-https.git] / Source / JavaScriptCore / runtime / VM.h
1 /*
2  * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer. 
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution. 
13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission. 
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28
29 #pragma once
30
31 #include "CallData.h"
32 #include "CodeSpecializationKind.h"
33 #include "CompleteSubspace.h"
34 #include "ConcurrentJSLock.h"
35 #include "ControlFlowProfiler.h"
36 #include "DateInstanceCache.h"
37 #include "DeleteAllCodeEffort.h"
38 #include "ExceptionEventLocation.h"
39 #include "ExecutableAllocator.h"
40 #include "FunctionHasExecutedCache.h"
41 #include "FuzzerAgent.h"
42 #include "Heap.h"
43 #include "Intrinsic.h"
44 #include "IsoCellSet.h"
45 #include "IsoSubspace.h"
46 #include "JITThunks.h"
47 #include "JSCJSValue.h"
48 #include "JSLock.h"
49 #include "MacroAssemblerCodeRef.h"
50 #include "Microtask.h"
51 #include "NumericStrings.h"
52 #include "SmallStrings.h"
53 #include "Strong.h"
54 #include "StructureCache.h"
55 #include "SubspaceAccess.h"
56 #include "VMTraps.h"
57 #include "WasmContext.h"
58 #include "Watchpoint.h"
59 #include <wtf/BumpPointerAllocator.h>
60 #include <wtf/CheckedArithmetic.h>
61 #include <wtf/DateMath.h>
62 #include <wtf/Deque.h>
63 #include <wtf/DoublyLinkedList.h>
64 #include <wtf/Forward.h>
65 #include <wtf/Gigacage.h>
66 #include <wtf/HashMap.h>
67 #include <wtf/HashSet.h>
68 #include <wtf/SetForScope.h>
69 #include <wtf/StackBounds.h>
70 #include <wtf/StackPointer.h>
71 #include <wtf/Stopwatch.h>
72 #include <wtf/ThreadSafeRefCounted.h>
73 #include <wtf/ThreadSpecific.h>
74 #include <wtf/UniqueArray.h>
75 #include <wtf/text/SymbolRegistry.h>
76 #include <wtf/text/WTFString.h>
77 #if ENABLE(REGEXP_TRACING)
78 #include <wtf/ListHashSet.h>
79 #endif
80
81 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
82 #include <wtf/StackTrace.h>
83 #endif
84
85 // Enable the Objective-C API for platforms with a modern runtime. This has to match exactly what we
86 // have in JSBase.h.
87 #if !defined(JSC_OBJC_API_ENABLED)
88 #if (defined(__clang__) && defined(__APPLE__) && ((defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && !defined(__i386__)) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)))
89 #define JSC_OBJC_API_ENABLED 1
90 #else
91 #define JSC_OBJC_API_ENABLED 0
92 #endif
93 #endif
94
95 namespace WTF {
96 class SimpleStats;
97 } // namespace WTF
98 using WTF::SimpleStats;
99
100 namespace JSC {
101
102 class BuiltinExecutables;
103 class BytecodeIntrinsicRegistry;
104 class CodeBlock;
105 class CodeCache;
106 class CommonIdentifiers;
107 class CompactVariableMap;
108 class CustomGetterSetter;
109 class DOMAttributeGetterSetter;
110 class ExecState;
111 class Exception;
112 class ExceptionScope;
113 class FastMallocAlignedMemoryAllocator;
114 class GigacageAlignedMemoryAllocator;
115 class HandleStack;
116 class TypeProfiler;
117 class TypeProfilerLog;
118 class HasOwnPropertyCache;
119 class HeapProfiler;
120 class Identifier;
121 class Interpreter;
122 class JSCustomGetterSetterFunction;
123 class JSDestructibleObjectHeapCellType;
124 class JSGlobalObject;
125 class JSObject;
126 class JSRunLoopTimer;
127 class JSStringHeapCellType;
128 class JSWebAssemblyCodeBlockHeapCellType;
129 class JSWebAssemblyInstance;
130 class LLIntOffsetsExtractor;
131 class NativeExecutable;
132 class PromiseDeferredTimer;
133 class RegExp;
134 class RegExpCache;
135 class Register;
136 class RegisterAtOffsetList;
137 #if ENABLE(SAMPLING_PROFILER)
138 class SamplingProfiler;
139 #endif
140 class ShadowChicken;
141 class ScriptExecutable;
142 class SourceProvider;
143 class SourceProviderCache;
144 class StackFrame;
145 class Structure;
146 #if ENABLE(REGEXP_TRACING)
147 class RegExp;
148 #endif
149 class Symbol;
150 class TypedArrayController;
151 class UnlinkedCodeBlock;
152 class UnlinkedEvalCodeBlock;
153 class UnlinkedFunctionExecutable;
154 class UnlinkedProgramCodeBlock;
155 class UnlinkedModuleProgramCodeBlock;
156 class VirtualRegister;
157 class VMEntryScope;
158 class Watchdog;
159 class Watchpoint;
160 class WatchpointSet;
161 class WebAssemblyFunctionHeapCellType;
162
163 #if ENABLE(FTL_JIT)
164 namespace FTL {
165 class Thunks;
166 }
167 #endif // ENABLE(FTL_JIT)
168 namespace Profiler {
169 class Database;
170 }
171 namespace DOMJIT {
172 class Signature;
173 }
174
175 struct EntryFrame;
176 struct HashTable;
177 struct Instruction;
178 struct ValueProfile;
179
180 typedef ExecState CallFrame;
181
182 struct LocalTimeOffsetCache {
183     LocalTimeOffsetCache()
184         : start(0.0)
185         , end(-1.0)
186         , increment(0.0)
187         , timeType(WTF::UTCTime)
188     {
189     }
190
191     void reset()
192     {
193         offset = LocalTimeOffset();
194         start = 0.0;
195         end = -1.0;
196         increment = 0.0;
197         timeType = WTF::UTCTime;
198     }
199
200     LocalTimeOffset offset;
201     double start;
202     double end;
203     double increment;
204     WTF::TimeType timeType;
205 };
206
207 class QueuedTask {
208     WTF_MAKE_NONCOPYABLE(QueuedTask);
209     WTF_MAKE_FAST_ALLOCATED;
210 public:
211     void run();
212
213     QueuedTask(VM& vm, JSGlobalObject* globalObject, Ref<Microtask>&& microtask)
214         : m_globalObject(vm, globalObject)
215         , m_microtask(WTFMove(microtask))
216     {
217     }
218
219 private:
220     Strong<JSGlobalObject> m_globalObject;
221     Ref<Microtask> m_microtask;
222 };
223
224 class ConservativeRoots;
225
226 #if COMPILER(MSVC)
227 #pragma warning(push)
228 #pragma warning(disable: 4200) // Disable "zero-sized array in struct/union" warning
229 #endif
230 struct ScratchBuffer {
231     ScratchBuffer()
232     {
233         u.m_activeLength = 0;
234     }
235
236     static ScratchBuffer* create(size_t size)
237     {
238         ScratchBuffer* result = new (fastMalloc(ScratchBuffer::allocationSize(size))) ScratchBuffer;
239
240         return result;
241     }
242
243     static size_t allocationSize(Checked<size_t> bufferSize) { return (sizeof(ScratchBuffer) + bufferSize).unsafeGet(); }
244     void setActiveLength(size_t activeLength) { u.m_activeLength = activeLength; }
245     size_t activeLength() const { return u.m_activeLength; };
246     size_t* addressOfActiveLength() { return &u.m_activeLength; };
247     void* dataBuffer() { return m_buffer; }
248
249     union {
250         size_t m_activeLength;
251         double pad; // Make sure m_buffer is double aligned.
252     } u;
253 #if CPU(MIPS) && (defined WTF_MIPS_ARCH_REV && WTF_MIPS_ARCH_REV == 2)
254     alignas(8) void* m_buffer[0];
255 #else
256     void* m_buffer[0];
257 #endif
258 };
259 #if COMPILER(MSVC)
260 #pragma warning(pop)
261 #endif
262
263 class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
264 public:
265     // WebCore has a one-to-one mapping of threads to VMs;
266     // create() should only be called once
267     // on a thread, this is the 'default' VM (it uses the
268     // thread's default string uniquing table from Thread::current()).
269     // API contexts created using the new context group aware interface
270     // create APIContextGroup objects which require less locking of JSC
271     // than the old singleton APIShared VM created for use by
272     // the original API.
273     enum VMType { Default, APIContextGroup, APIShared };
274
275     struct ClientData {
276         JS_EXPORT_PRIVATE virtual ~ClientData() = 0;
277     };
278
279     bool isSharedInstance() { return vmType == APIShared; }
280     bool usingAPI() { return vmType != Default; }
281     JS_EXPORT_PRIVATE static bool sharedInstanceExists();
282     JS_EXPORT_PRIVATE static VM& sharedInstance();
283
284     JS_EXPORT_PRIVATE static Ref<VM> create(HeapType = SmallHeap);
285     static Ref<VM> createContextGroup(HeapType = SmallHeap);
286     JS_EXPORT_PRIVATE ~VM();
287
288     Watchdog& ensureWatchdog();
289     Watchdog* watchdog() { return m_watchdog.get(); }
290
291     HeapProfiler* heapProfiler() const { return m_heapProfiler.get(); }
292     JS_EXPORT_PRIVATE HeapProfiler& ensureHeapProfiler();
293
294 #if ENABLE(SAMPLING_PROFILER)
295     SamplingProfiler* samplingProfiler() { return m_samplingProfiler.get(); }
296     JS_EXPORT_PRIVATE SamplingProfiler& ensureSamplingProfiler(RefPtr<Stopwatch>&&);
297 #endif
298
299     FuzzerAgent* fuzzerAgent() const { return m_fuzzerAgent.get(); }
300     void setFuzzerAgent(std::unique_ptr<FuzzerAgent>&& fuzzerAgent)
301     {
302         m_fuzzerAgent = WTFMove(fuzzerAgent);
303     }
304
305     static unsigned numberOfIDs() { return s_numberOfIDs.load(); }
306     unsigned id() const { return m_id; }
307     bool isEntered() const { return !!entryScope; }
308
309     inline CallFrame* topJSCallFrame() const;
310
311     // Global object in which execution began.
312     JS_EXPORT_PRIVATE JSGlobalObject* vmEntryGlobalObject(const CallFrame*) const;
313
314 private:
315     unsigned nextID();
316
317     static Atomic<unsigned> s_numberOfIDs;
318
319     unsigned m_id;
320     RefPtr<JSLock> m_apiLock;
321 #if USE(CF)
322     // These need to be initialized before heap below.
323     RetainPtr<CFRunLoopRef> m_runLoop;
324 #endif
325
326 public:
327     Heap heap;
328     
329     std::unique_ptr<FastMallocAlignedMemoryAllocator> fastMallocAllocator;
330     std::unique_ptr<GigacageAlignedMemoryAllocator> primitiveGigacageAllocator;
331     std::unique_ptr<GigacageAlignedMemoryAllocator> jsValueGigacageAllocator;
332
333     std::unique_ptr<HeapCellType> auxiliaryHeapCellType;
334     std::unique_ptr<HeapCellType> immutableButterflyHeapCellType;
335     std::unique_ptr<HeapCellType> cellHeapCellType;
336     std::unique_ptr<HeapCellType> destructibleCellHeapCellType;
337     std::unique_ptr<JSStringHeapCellType> stringHeapCellType;
338     std::unique_ptr<JSDestructibleObjectHeapCellType> destructibleObjectHeapCellType;
339 #if ENABLE(WEBASSEMBLY)
340     std::unique_ptr<JSWebAssemblyCodeBlockHeapCellType> webAssemblyCodeBlockHeapCellType;
341     std::unique_ptr<WebAssemblyFunctionHeapCellType> webAssemblyFunctionHeapCellType;
342 #endif
343     
344     CompleteSubspace primitiveGigacageAuxiliarySpace; // Typed arrays, strings, bitvectors, etc go here.
345     CompleteSubspace jsValueGigacageAuxiliarySpace; // Butterflies, arrays of JSValues, etc go here.
346     CompleteSubspace immutableButterflyJSValueGigacageAuxiliarySpace; // JSImmutableButterfly goes here.
347
348     // We make cross-cutting assumptions about typed arrays being in the primitive Gigacage and butterflies
349     // being in the JSValue gigacage. For some types, it's super obvious where they should go, and so we
350     // can hardcode that fact. But sometimes it's not clear, so we abstract it by having a Gigacage::Kind
351     // constant somewhere.
352     // FIXME: Maybe it would be better if everyone abstracted this?
353     // https://bugs.webkit.org/show_bug.cgi?id=175248
354     ALWAYS_INLINE CompleteSubspace& gigacageAuxiliarySpace(Gigacage::Kind kind)
355     {
356         switch (kind) {
357         case Gigacage::ReservedForFlagsAndNotABasePtr:
358             RELEASE_ASSERT_NOT_REACHED();
359         case Gigacage::Primitive:
360             return primitiveGigacageAuxiliarySpace;
361         case Gigacage::JSValue:
362             return jsValueGigacageAuxiliarySpace;
363         }
364         RELEASE_ASSERT_NOT_REACHED();
365         return primitiveGigacageAuxiliarySpace;
366     }
367     
368     // Whenever possible, use subspaceFor<CellType>(vm) to get one of these subspaces.
369     CompleteSubspace cellSpace;
370     CompleteSubspace jsValueGigacageCellSpace; // FIXME: This space is problematic because we have things in here like DirectArguments and ScopedArguments; those should be split into JSValueOOB cells and JSValueStrict auxiliaries. https://bugs.webkit.org/show_bug.cgi?id=182858
371     CompleteSubspace destructibleCellSpace;
372     CompleteSubspace stringSpace;
373     CompleteSubspace destructibleObjectSpace;
374     CompleteSubspace eagerlySweptDestructibleObjectSpace;
375     
376     IsoSubspace executableToCodeBlockEdgeSpace;
377     IsoSubspace functionSpace;
378     IsoSubspace internalFunctionSpace;
379     IsoSubspace nativeExecutableSpace;
380     IsoSubspace propertyTableSpace;
381     IsoSubspace structureRareDataSpace;
382     IsoSubspace structureSpace;
383
384 #define DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(name) \
385     template<SubspaceAccess mode> \
386     IsoSubspace* name() \
387     { \
388         if (m_##name || mode == SubspaceAccess::Concurrently) \
389             return m_##name.get(); \
390         return name##Slow(); \
391     } \
392     IsoSubspace* name##Slow(); \
393     std::unique_ptr<IsoSubspace> m_##name;
394
395
396 #if JSC_OBJC_API_ENABLED
397     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(objCCallbackFunctionSpace)
398 #endif
399     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(boundFunctionSpace)
400     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(callbackFunctionSpace)
401     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(customGetterSetterFunctionSpace)
402     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(errorInstanceSpace)
403     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(nativeStdFunctionSpace)
404     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(proxyRevokeSpace)
405     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakSetSpace)
406     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakMapSpace)
407 #if ENABLE(WEBASSEMBLY)
408     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyCodeBlockSpace)
409     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyFunctionSpace)
410     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyWrapperFunctionSpace)
411 #endif
412
413 #undef DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER
414     
415     IsoCellSet executableToCodeBlockEdgesWithConstraints;
416     IsoCellSet executableToCodeBlockEdgesWithFinalizers;
417
418 #define DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(name) \
419     template<SubspaceAccess mode> \
420     IsoSubspace* name() \
421     { \
422         if (auto* spaceAndSet = m_##name.get()) \
423             return &spaceAndSet->space; \
424         if (mode == SubspaceAccess::Concurrently) \
425             return nullptr; \
426         return name##Slow(); \
427     } \
428     IsoSubspace* name##Slow(); \
429     std::unique_ptr<SpaceAndSet> m_##name;
430     
431     struct SpaceAndSet {
432         WTF_MAKE_STRUCT_FAST_ALLOCATED;
433
434         IsoSubspace space;
435         IsoCellSet set;
436         
437         template<typename... Arguments>
438         SpaceAndSet(Arguments&&... arguments)
439             : space(std::forward<Arguments>(arguments)...)
440             , set(space)
441         {
442         }
443         
444         static IsoCellSet& setFor(Subspace& space)
445         {
446             return *bitwise_cast<IsoCellSet*>(
447                 bitwise_cast<char*>(&space) -
448                 OBJECT_OFFSETOF(SpaceAndSet, space) +
449                 OBJECT_OFFSETOF(SpaceAndSet, set));
450         }
451     };
452     
453     SpaceAndSet codeBlockSpace;
454     DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(inferredValueSpace)
455
456     template<typename Func>
457     void forEachCodeBlockSpace(const Func& func)
458     {
459         // This should not include webAssemblyCodeBlockSpace because this is about subsclasses of
460         // JSC::CodeBlock.
461         func(codeBlockSpace);
462     }
463
464     DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(evalExecutableSpace)
465     DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(moduleProgramExecutableSpace)
466     SpaceAndSet functionExecutableSpace;
467     SpaceAndSet programExecutableSpace;
468
469     template<typename Func>
470     void forEachScriptExecutableSpace(const Func& func)
471     {
472         if (m_evalExecutableSpace)
473             func(*m_evalExecutableSpace);
474         func(functionExecutableSpace);
475         if (m_moduleProgramExecutableSpace)
476             func(*m_moduleProgramExecutableSpace);
477         func(programExecutableSpace);
478     }
479
480     SpaceAndSet unlinkedFunctionExecutableSpace;
481
482 #undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER
483
484     VMType vmType;
485     ClientData* clientData;
486     EntryFrame* topEntryFrame;
487     // NOTE: When throwing an exception while rolling back the call frame, this may be equal to
488     // topEntryFrame.
489     // FIXME: This should be a void*, because it might not point to a CallFrame.
490     // https://bugs.webkit.org/show_bug.cgi?id=160441
491     ExecState* topCallFrame { nullptr };
492 #if ENABLE(WEBASSEMBLY)
493     Wasm::Context wasmContext;
494 #endif
495     Strong<Structure> structureStructure;
496     Strong<Structure> structureRareDataStructure;
497     Strong<Structure> terminatedExecutionErrorStructure;
498     Strong<Structure> stringStructure;
499     Strong<Structure> propertyNameEnumeratorStructure;
500     Strong<Structure> customGetterSetterStructure;
501     Strong<Structure> domAttributeGetterSetterStructure;
502     Strong<Structure> scopedArgumentsTableStructure;
503     Strong<Structure> apiWrapperStructure;
504     Strong<Structure> nativeExecutableStructure;
505     Strong<Structure> evalExecutableStructure;
506     Strong<Structure> programExecutableStructure;
507     Strong<Structure> functionExecutableStructure;
508 #if ENABLE(WEBASSEMBLY)
509     Strong<Structure> webAssemblyCodeBlockStructure;
510 #endif
511     Strong<Structure> moduleProgramExecutableStructure;
512     Strong<Structure> regExpStructure;
513     Strong<Structure> symbolStructure;
514     Strong<Structure> symbolTableStructure;
515     Strong<Structure> fixedArrayStructure;
516     Strong<Structure> immutableButterflyStructures[NumberOfCopyOnWriteIndexingModes];
517     Strong<Structure> sourceCodeStructure;
518     Strong<Structure> scriptFetcherStructure;
519     Strong<Structure> scriptFetchParametersStructure;
520     Strong<Structure> structureChainStructure;
521     Strong<Structure> sparseArrayValueMapStructure;
522     Strong<Structure> templateObjectDescriptorStructure;
523     Strong<Structure> arrayBufferNeuteringWatchpointStructure;
524     Strong<Structure> unlinkedFunctionExecutableStructure;
525     Strong<Structure> unlinkedProgramCodeBlockStructure;
526     Strong<Structure> unlinkedEvalCodeBlockStructure;
527     Strong<Structure> unlinkedFunctionCodeBlockStructure;
528     Strong<Structure> unlinkedModuleProgramCodeBlockStructure;
529     Strong<Structure> propertyTableStructure;
530     Strong<Structure> inferredValueStructure;
531     Strong<Structure> functionRareDataStructure;
532     Strong<Structure> exceptionStructure;
533     Strong<Structure> promiseDeferredStructure;
534     Strong<Structure> internalPromiseDeferredStructure;
535     Strong<Structure> nativeStdFunctionCellStructure;
536     Strong<Structure> programCodeBlockStructure;
537     Strong<Structure> moduleProgramCodeBlockStructure;
538     Strong<Structure> evalCodeBlockStructure;
539     Strong<Structure> functionCodeBlockStructure;
540     Strong<Structure> hashMapBucketSetStructure;
541     Strong<Structure> hashMapBucketMapStructure;
542     Strong<Structure> bigIntStructure;
543     Strong<Structure> executableToCodeBlockEdgeStructure;
544
545     Strong<Structure> m_setIteratorStructure;
546     Strong<Structure> m_mapIteratorStructure;
547
548     Strong<JSCell> emptyPropertyNameEnumerator;
549
550     Strong<JSCell> m_sentinelSetBucket;
551     Strong<JSCell> m_sentinelMapBucket;
552
553     std::unique_ptr<PromiseDeferredTimer> promiseDeferredTimer;
554     
555     JSCell* currentlyDestructingCallbackObject;
556     const ClassInfo* currentlyDestructingCallbackObjectClassInfo { nullptr };
557
558     AtomicStringTable* m_atomicStringTable;
559     WTF::SymbolRegistry m_symbolRegistry;
560     CommonIdentifiers* propertyNames;
561     const ArgList* emptyList;
562     SmallStrings smallStrings;
563     NumericStrings numericStrings;
564     DateInstanceCache dateInstanceCache;
565     std::unique_ptr<SimpleStats> machineCodeBytesPerBytecodeWordForBaselineJIT;
566     WeakGCMap<std::pair<CustomGetterSetter*, int>, JSCustomGetterSetterFunction> customGetterSetterFunctionMap;
567     WeakGCMap<StringImpl*, JSString, PtrHash<StringImpl*>> stringCache;
568     Strong<JSString> lastCachedString;
569
570     AtomicStringTable* atomicStringTable() const { return m_atomicStringTable; }
571     WTF::SymbolRegistry& symbolRegistry() { return m_symbolRegistry; }
572
573     Structure* setIteratorStructure()
574     {
575         if (LIKELY(m_setIteratorStructure))
576             return m_setIteratorStructure.get();
577         return setIteratorStructureSlow();
578     }
579
580     Structure* mapIteratorStructure()
581     {
582         if (LIKELY(m_mapIteratorStructure))
583             return m_mapIteratorStructure.get();
584         return mapIteratorStructureSlow();
585     }
586
587     JSCell* sentinelSetBucket()
588     {
589         if (LIKELY(m_sentinelSetBucket))
590             return m_sentinelSetBucket.get();
591         return sentinelSetBucketSlow();
592     }
593
594     JSCell* sentinelMapBucket()
595     {
596         if (LIKELY(m_sentinelMapBucket))
597             return m_sentinelMapBucket.get();
598         return sentinelMapBucketSlow();
599     }
600
601     WeakGCMap<SymbolImpl*, Symbol, PtrHash<SymbolImpl*>> symbolImplToSymbolMap;
602
603     enum class DeletePropertyMode {
604         // Default behaviour of deleteProperty, matching the spec.
605         Default,
606         // This setting causes deleteProperty to force deletion of all
607         // properties including those that are non-configurable (DontDelete).
608         IgnoreConfigurable
609     };
610
611     DeletePropertyMode deletePropertyMode()
612     {
613         return m_deletePropertyMode;
614     }
615
616     class DeletePropertyModeScope {
617     public:
618         DeletePropertyModeScope(VM& vm, DeletePropertyMode mode)
619             : m_vm(vm)
620             , m_previousMode(vm.m_deletePropertyMode)
621         {
622             m_vm.m_deletePropertyMode = mode;
623         }
624
625         ~DeletePropertyModeScope()
626         {
627             m_vm.m_deletePropertyMode = m_previousMode;
628         }
629
630     private:
631         VM& m_vm;
632         DeletePropertyMode m_previousMode;
633     };
634
635     static JS_EXPORT_PRIVATE bool canUseAssembler();
636     static JS_EXPORT_PRIVATE bool canUseRegExpJIT();
637     static JS_EXPORT_PRIVATE bool isInMiniMode();
638
639     static void computeCanUseJIT();
640     ALWAYS_INLINE static bool canUseJIT()
641     {
642 #if ENABLE(JIT)
643 #if !ASSERT_DISABLED
644         RELEASE_ASSERT(s_canUseJITIsSet);
645 #endif
646         return s_canUseJIT;
647 #else
648         return false;
649 #endif
650     }
651
652     SourceProviderCache* addSourceProviderCache(SourceProvider*);
653     void clearSourceProviderCaches();
654
655     StructureCache structureCache;
656
657     typedef HashMap<RefPtr<SourceProvider>, RefPtr<SourceProviderCache>> SourceProviderCacheMap;
658     SourceProviderCacheMap sourceProviderCacheMap;
659     Interpreter* interpreter;
660 #if ENABLE(JIT)
661     std::unique_ptr<JITThunks> jitStubs;
662     MacroAssemblerCodeRef<JITThunkPtrTag> getCTIStub(ThunkGenerator generator)
663     {
664         return jitStubs->ctiStub(this, generator);
665     }
666
667 #endif // ENABLE(JIT)
668 #if ENABLE(FTL_JIT)
669     std::unique_ptr<FTL::Thunks> ftlThunks;
670 #endif
671     NativeExecutable* getHostFunction(NativeFunction, NativeFunction constructor, const String& name);
672     NativeExecutable* getHostFunction(NativeFunction, Intrinsic, NativeFunction constructor, const DOMJIT::Signature*, const String& name);
673
674     MacroAssemblerCodePtr<JSEntryPtrTag> getCTIInternalFunctionTrampolineFor(CodeSpecializationKind);
675
676     static ptrdiff_t exceptionOffset()
677     {
678         return OBJECT_OFFSETOF(VM, m_exception);
679     }
680
681     static ptrdiff_t callFrameForCatchOffset()
682     {
683         return OBJECT_OFFSETOF(VM, callFrameForCatch);
684     }
685
686     static ptrdiff_t topEntryFrameOffset()
687     {
688         return OBJECT_OFFSETOF(VM, topEntryFrame);
689     }
690
691     void restorePreviousException(Exception* exception) { setException(exception); }
692
693     void clearLastException() { m_lastException = nullptr; }
694
695     ExecState** addressOfCallFrameForCatch() { return &callFrameForCatch; }
696
697     JSCell** addressOfException() { return reinterpret_cast<JSCell**>(&m_exception); }
698
699     Exception* lastException() const { return m_lastException; }
700     JSCell** addressOfLastException() { return reinterpret_cast<JSCell**>(&m_lastException); }
701
702     // This should only be used for test or assertion code that wants to inspect
703     // the pending exception without interfering with Throw/CatchScopes.
704     Exception* exceptionForInspection() const { return m_exception; }
705
706     void setFailNextNewCodeBlock() { m_failNextNewCodeBlock = true; }
707     bool getAndClearFailNextNewCodeBlock()
708     {
709         bool result = m_failNextNewCodeBlock;
710         m_failNextNewCodeBlock = false;
711         return result;
712     }
713     
714     ALWAYS_INLINE Structure* getStructure(StructureID id)
715     {
716         return heap.structureIDTable().get(decontaminate(id));
717     }
718     
719     void* stackPointerAtVMEntry() const { return m_stackPointerAtVMEntry; }
720     void setStackPointerAtVMEntry(void*);
721
722     size_t softReservedZoneSize() const { return m_currentSoftReservedZoneSize; }
723     size_t updateSoftReservedZoneSize(size_t softReservedZoneSize);
724     
725     static size_t committedStackByteCount();
726     inline bool ensureStackCapacityFor(Register* newTopOfStack);
727
728     void* stackLimit() { return m_stackLimit; }
729     void* softStackLimit() { return m_softStackLimit; }
730     void** addressOfSoftStackLimit() { return &m_softStackLimit; }
731 #if ENABLE(C_LOOP)
732     void* cloopStackLimit() { return m_cloopStackLimit; }
733     void setCLoopStackLimit(void* limit) { m_cloopStackLimit = limit; }
734 #endif
735
736     inline bool isSafeToRecurseSoft() const;
737     bool isSafeToRecurse() const
738     {
739         return isSafeToRecurse(m_stackLimit);
740     }
741
742     void** addressOfLastStackTop() { return &m_lastStackTop; }
743     void* lastStackTop() { return m_lastStackTop; }
744     void setLastStackTop(void*);
745     
746     void firePrimitiveGigacageEnabledIfNecessary()
747     {
748         if (m_needToFirePrimitiveGigacageEnabled) {
749             m_needToFirePrimitiveGigacageEnabled = false;
750             m_primitiveGigacageEnabled.fireAll(*this, "Primitive gigacage disabled asynchronously");
751         }
752     }
753
754     JSValue hostCallReturnValue;
755     unsigned varargsLength;
756     ExecState* newCallFrameReturnValue;
757     ExecState* callFrameForCatch;
758     void* targetMachinePCForThrow;
759     const Instruction* targetInterpreterPCForThrow;
760     uint32_t osrExitIndex;
761     void* osrExitJumpDestination;
762     bool isExecutingInRegExpJIT { false };
763
764     // The threading protocol here is as follows:
765     // - You can call scratchBufferForSize from any thread.
766     // - You can only set the ScratchBuffer's activeLength from the main thread.
767     // - You can only write to entries in the ScratchBuffer from the main thread.
768     ScratchBuffer* scratchBufferForSize(size_t size);
769     void clearScratchBuffers();
770
771     EncodedJSValue* exceptionFuzzingBuffer(size_t size)
772     {
773         ASSERT(Options::useExceptionFuzz());
774         if (!m_exceptionFuzzBuffer)
775             m_exceptionFuzzBuffer = MallocPtr<EncodedJSValue>::malloc(size);
776         return m_exceptionFuzzBuffer.get();
777     }
778
779     void gatherScratchBufferRoots(ConservativeRoots&);
780
781     VMEntryScope* entryScope;
782
783     JSObject* stringRecursionCheckFirstObject { nullptr };
784     HashSet<JSObject*> stringRecursionCheckVisitedObjects;
785     
786     LocalTimeOffsetCache localTimeOffsetCache;
787
788     String cachedDateString;
789     double cachedDateStringValue;
790
791     std::unique_ptr<Profiler::Database> m_perBytecodeProfiler;
792     RefPtr<TypedArrayController> m_typedArrayController;
793     RegExpCache* m_regExpCache;
794     BumpPointerAllocator m_regExpAllocator;
795     ConcurrentJSLock m_regExpAllocatorLock;
796
797 #if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
798     static constexpr size_t patternContextBufferSize = 8192; // Space allocated to save nested parenthesis context
799     UniqueArray<char> m_regExpPatternContexBuffer;
800     Lock m_regExpPatternContextLock;
801     char* acquireRegExpPatternContexBuffer();
802     void releaseRegExpPatternContexBuffer();
803 #endif
804
805     Ref<CompactVariableMap> m_compactVariableMap;
806
807     std::unique_ptr<HasOwnPropertyCache> m_hasOwnPropertyCache;
808     ALWAYS_INLINE HasOwnPropertyCache* hasOwnPropertyCache() { return m_hasOwnPropertyCache.get(); }
809     HasOwnPropertyCache* ensureHasOwnPropertyCache();
810
811 #if ENABLE(REGEXP_TRACING)
812     typedef ListHashSet<RegExp*> RTTraceList;
813     RTTraceList* m_rtTraceList;
814 #endif
815
816 #if JSC_OBJC_API_ENABLED
817     void* m_apiWrapper { nullptr };
818 #endif
819
820     JS_EXPORT_PRIVATE void resetDateCache();
821
822     RegExpCache* regExpCache() { return m_regExpCache; }
823 #if ENABLE(REGEXP_TRACING)
824     void addRegExpToTrace(RegExp*);
825 #endif
826     JS_EXPORT_PRIVATE void dumpRegExpTrace();
827
828     bool isCollectorBusyOnCurrentThread() { return heap.isCurrentThreadBusy(); }
829
830 #if ENABLE(GC_VALIDATION)
831     bool isInitializingObject() const; 
832     void setInitializingObjectClass(const ClassInfo*);
833 #endif
834
835     bool currentThreadIsHoldingAPILock() const { return m_apiLock->currentThreadIsHoldingLock(); }
836
837     JSLock& apiLock() { return *m_apiLock; }
838     CodeCache* codeCache() { return m_codeCache.get(); }
839
840     JS_EXPORT_PRIVATE void whenIdle(Function<void()>&&);
841
842     JS_EXPORT_PRIVATE void deleteAllCode(DeleteAllCodeEffort);
843     JS_EXPORT_PRIVATE void deleteAllLinkedCode(DeleteAllCodeEffort);
844
845     void shrinkFootprintWhenIdle();
846
847     WatchpointSet* ensureWatchpointSetForImpureProperty(const Identifier&);
848     void registerWatchpointForImpureProperty(const Identifier&, Watchpoint*);
849     
850     // FIXME: Use AtomicString once it got merged with Identifier.
851     JS_EXPORT_PRIVATE void addImpureProperty(const String&);
852     
853     InlineWatchpointSet& primitiveGigacageEnabled() { return m_primitiveGigacageEnabled; }
854
855     BuiltinExecutables* builtinExecutables() { return m_builtinExecutables.get(); }
856
857     bool enableTypeProfiler();
858     bool disableTypeProfiler();
859     TypeProfilerLog* typeProfilerLog() { return m_typeProfilerLog.get(); }
860     TypeProfiler* typeProfiler() { return m_typeProfiler.get(); }
861     JS_EXPORT_PRIVATE void dumpTypeProfilerData();
862
863     FunctionHasExecutedCache* functionHasExecutedCache() { return &m_functionHasExecutedCache; }
864
865     ControlFlowProfiler* controlFlowProfiler() { return m_controlFlowProfiler.get(); }
866     bool enableControlFlowProfiler();
867     bool disableControlFlowProfiler();
868
869     void queueMicrotask(JSGlobalObject&, Ref<Microtask>&&);
870     JS_EXPORT_PRIVATE void drainMicrotasks();
871     ALWAYS_INLINE void setOnEachMicrotaskTick(WTF::Function<void(VM&)>&& func) { m_onEachMicrotaskTick = WTFMove(func); }
872     void setGlobalConstRedeclarationShouldThrow(bool globalConstRedeclarationThrow) { m_globalConstRedeclarationShouldThrow = globalConstRedeclarationThrow; }
873     ALWAYS_INLINE bool globalConstRedeclarationShouldThrow() const { return m_globalConstRedeclarationShouldThrow; }
874
875     void setShouldBuildPCToCodeOriginMapping() { m_shouldBuildPCToCodeOriginMapping = true; }
876     bool shouldBuilderPCToCodeOriginMapping() const { return m_shouldBuildPCToCodeOriginMapping; }
877
878     BytecodeIntrinsicRegistry& bytecodeIntrinsicRegistry() { return *m_bytecodeIntrinsicRegistry; }
879     
880     ShadowChicken* shadowChicken() { return m_shadowChicken.get(); }
881     void ensureShadowChicken();
882     
883     template<typename Func>
884     void logEvent(CodeBlock*, const char* summary, const Func& func);
885
886     Optional<RefPtr<Thread>> ownerThread() const { return m_apiLock->ownerThread(); }
887
888     VMTraps& traps() { return m_traps; }
889
890     void handleTraps(ExecState* exec, VMTraps::Mask mask = VMTraps::Mask::allEventTypes()) { m_traps.handleTraps(exec, mask); }
891
892     bool needTrapHandling() { return m_traps.needTrapHandling(); }
893     bool needTrapHandling(VMTraps::Mask mask) { return m_traps.needTrapHandling(mask); }
894     void* needTrapHandlingAddress() { return m_traps.needTrapHandlingAddress(); }
895
896     void notifyNeedDebuggerBreak() { m_traps.fireTrap(VMTraps::NeedDebuggerBreak); }
897     void notifyNeedTermination() { m_traps.fireTrap(VMTraps::NeedTermination); }
898     void notifyNeedWatchdogCheck() { m_traps.fireTrap(VMTraps::NeedWatchdogCheck); }
899
900 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
901     StackTrace* nativeStackTraceOfLastThrow() const { return m_nativeStackTraceOfLastThrow.get(); }
902     Thread* throwingThread() const { return m_throwingThread.get(); }
903     bool needExceptionCheck() const { return m_needExceptionCheck; }
904 #endif
905
906 #if USE(CF)
907     CFRunLoopRef runLoop() const { return m_runLoop.get(); }
908     JS_EXPORT_PRIVATE void setRunLoop(CFRunLoopRef);
909 #endif // USE(CF)
910
911     static void setCrashOnVMCreation(bool);
912
913     class DeferExceptionScope {
914     public:
915         DeferExceptionScope(VM& vm)
916             : m_savedException(vm.m_exception, nullptr)
917             , m_savedLastException(vm.m_lastException, nullptr)
918         {
919         }
920
921     private:
922         SetForScope<Exception*> m_savedException;
923         SetForScope<Exception*> m_savedLastException;
924     };
925
926 private:
927     friend class LLIntOffsetsExtractor;
928
929     VM(VMType, HeapType);
930     static VM*& sharedInstanceInternal();
931     void createNativeThunk();
932
933     JS_EXPORT_PRIVATE Structure* setIteratorStructureSlow();
934     JS_EXPORT_PRIVATE Structure* mapIteratorStructureSlow();
935     JSCell* sentinelSetBucketSlow();
936     JSCell* sentinelMapBucketSlow();
937
938     void updateStackLimits();
939
940     bool isSafeToRecurse(void* stackLimit) const
941     {
942         ASSERT(Thread::current().stack().isGrowingDownward());
943         void* curr = currentStackPointer();
944         return curr >= stackLimit;
945     }
946
947     void setException(Exception* exception)
948     {
949         m_exception = exception;
950         m_lastException = exception;
951     }
952     Exception* exception() const
953     {
954 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
955         m_needExceptionCheck = false;
956 #endif
957         return m_exception;
958     }
959     void clearException()
960     {
961 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
962         m_needExceptionCheck = false;
963         m_nativeStackTraceOfLastThrow = nullptr;
964         m_throwingThread = nullptr;
965 #endif
966         m_exception = nullptr;
967     }
968
969 #if ENABLE(C_LOOP)
970     bool ensureStackCapacityForCLoop(Register* newTopOfStack);
971     bool isSafeToRecurseSoftCLoop() const;
972 #endif // ENABLE(C_LOOP)
973
974     JS_EXPORT_PRIVATE Exception* throwException(ExecState*, Exception*);
975     JS_EXPORT_PRIVATE Exception* throwException(ExecState*, JSValue);
976     JS_EXPORT_PRIVATE Exception* throwException(ExecState*, JSObject*);
977
978 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
979     void verifyExceptionCheckNeedIsSatisfied(unsigned depth, ExceptionEventLocation&);
980 #endif
981     
982     static void primitiveGigacageDisabledCallback(void*);
983     void primitiveGigacageDisabled();
984
985 #if ENABLE(GC_VALIDATION)
986     const ClassInfo* m_initializingObjectClass;
987 #endif
988
989     void* m_stackPointerAtVMEntry;
990     size_t m_currentSoftReservedZoneSize;
991     void* m_stackLimit { nullptr };
992     void* m_softStackLimit { nullptr };
993 #if ENABLE(C_LOOP)
994     void* m_cloopStackLimit { nullptr };
995 #endif
996     void* m_lastStackTop { nullptr };
997
998     Exception* m_exception { nullptr };
999     Exception* m_lastException { nullptr };
1000 #if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
1001     ExceptionScope* m_topExceptionScope { nullptr };
1002     ExceptionEventLocation m_simulatedThrowPointLocation;
1003     unsigned m_simulatedThrowPointRecursionDepth { 0 };
1004     mutable bool m_needExceptionCheck { false };
1005     std::unique_ptr<StackTrace> m_nativeStackTraceOfLastThrow;
1006     std::unique_ptr<StackTrace> m_nativeStackTraceOfLastSimulatedThrow;
1007     RefPtr<Thread> m_throwingThread;
1008 #endif
1009
1010     bool m_failNextNewCodeBlock { false };
1011     DeletePropertyMode m_deletePropertyMode { DeletePropertyMode::Default };
1012     bool m_globalConstRedeclarationShouldThrow { true };
1013     bool m_shouldBuildPCToCodeOriginMapping { false };
1014     std::unique_ptr<CodeCache> m_codeCache;
1015     std::unique_ptr<BuiltinExecutables> m_builtinExecutables;
1016     HashMap<String, RefPtr<WatchpointSet>> m_impurePropertyWatchpointSets;
1017     std::unique_ptr<TypeProfiler> m_typeProfiler;
1018     std::unique_ptr<TypeProfilerLog> m_typeProfilerLog;
1019     unsigned m_typeProfilerEnabledCount;
1020     bool m_needToFirePrimitiveGigacageEnabled { false };
1021     Lock m_scratchBufferLock;
1022     Vector<ScratchBuffer*> m_scratchBuffers;
1023     size_t m_sizeOfLastScratchBuffer { 0 };
1024     InlineWatchpointSet m_primitiveGigacageEnabled;
1025     FunctionHasExecutedCache m_functionHasExecutedCache;
1026     std::unique_ptr<ControlFlowProfiler> m_controlFlowProfiler;
1027     unsigned m_controlFlowProfilerEnabledCount;
1028     Deque<std::unique_ptr<QueuedTask>> m_microtaskQueue;
1029     MallocPtr<EncodedJSValue> m_exceptionFuzzBuffer;
1030     VMTraps m_traps;
1031     RefPtr<Watchdog> m_watchdog;
1032     std::unique_ptr<HeapProfiler> m_heapProfiler;
1033 #if ENABLE(SAMPLING_PROFILER)
1034     RefPtr<SamplingProfiler> m_samplingProfiler;
1035 #endif
1036     std::unique_ptr<FuzzerAgent> m_fuzzerAgent;
1037     std::unique_ptr<ShadowChicken> m_shadowChicken;
1038     std::unique_ptr<BytecodeIntrinsicRegistry> m_bytecodeIntrinsicRegistry;
1039
1040     WTF::Function<void(VM&)> m_onEachMicrotaskTick;
1041
1042 #if ENABLE(JIT)
1043 #if !ASSERT_DISABLED
1044     JS_EXPORT_PRIVATE static bool s_canUseJITIsSet;
1045 #endif
1046     JS_EXPORT_PRIVATE static bool s_canUseJIT;
1047 #endif
1048
1049     VM* m_prev; // Required by DoublyLinkedListNode.
1050     VM* m_next; // Required by DoublyLinkedListNode.
1051
1052     // Friends for exception checking purpose only.
1053     friend class Heap;
1054     friend class CatchScope;
1055     friend class ExceptionScope;
1056     friend class ThrowScope;
1057     friend class VMTraps;
1058     friend class WTF::DoublyLinkedListNode<VM>;
1059 };
1060
1061 #if ENABLE(GC_VALIDATION)
1062 inline bool VM::isInitializingObject() const
1063 {
1064     return !!m_initializingObjectClass;
1065 }
1066
1067 inline void VM::setInitializingObjectClass(const ClassInfo* initializingObjectClass)
1068 {
1069     m_initializingObjectClass = initializingObjectClass;
1070 }
1071 #endif
1072
1073 inline Heap* WeakSet::heap() const
1074 {
1075     return &m_vm->heap;
1076 }
1077
1078 #if !ENABLE(C_LOOP)
1079 extern "C" void sanitizeStackForVMImpl(VM*);
1080 #endif
1081
1082 JS_EXPORT_PRIVATE void sanitizeStackForVM(VM*);
1083 void logSanitizeStack(VM*);
1084
1085 } // namespace JSC