LCOV - code coverage report
Current view: top level - src/objects - map.h (source / functions) Hit Total Coverage
Test: app.info Lines: 2 2 100.0 %
Date: 2019-01-20 Functions: 2 2 100.0 %

          Line data    Source code
       1             : // Copyright 2017 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #ifndef V8_OBJECTS_MAP_H_
       6             : #define V8_OBJECTS_MAP_H_
       7             : 
       8             : #include "src/globals.h"
       9             : #include "src/objects.h"
      10             : #include "src/objects/code.h"
      11             : #include "src/objects/heap-object.h"
      12             : 
      13             : // Has to be the last include (doesn't have include guards):
      14             : #include "src/objects/object-macros.h"
      15             : 
      16             : namespace v8 {
      17             : namespace internal {
      18             : 
      19             : enum InstanceType : uint16_t;
      20             : 
      21             : #define VISITOR_ID_LIST(V)             \
      22             :   V(AllocationSite)                    \
      23             :   V(BigInt)                            \
      24             :   V(ByteArray)                         \
      25             :   V(BytecodeArray)                     \
      26             :   V(Cell)                              \
      27             :   V(Code)                              \
      28             :   V(CodeDataContainer)                 \
      29             :   V(ConsString)                        \
      30             :   V(Context)                           \
      31             :   V(DataHandler)                       \
      32             :   V(DataObject)                        \
      33             :   V(DescriptorArray)                   \
      34             :   V(EmbedderDataArray)                 \
      35             :   V(EphemeronHashTable)                \
      36             :   V(FeedbackCell)                      \
      37             :   V(FeedbackVector)                    \
      38             :   V(FixedArray)                        \
      39             :   V(FixedDoubleArray)                  \
      40             :   V(FixedFloat64Array)                 \
      41             :   V(FixedTypedArrayBase)               \
      42             :   V(FreeSpace)                         \
      43             :   V(JSApiObject)                       \
      44             :   V(JSArrayBuffer)                     \
      45             :   V(JSDataView)                        \
      46             :   V(JSObject)                          \
      47             :   V(JSObjectFast)                      \
      48             :   V(JSTypedArray)                      \
      49             :   V(JSWeakCell)                        \
      50             :   V(JSWeakRef)                         \
      51             :   V(JSWeakCollection)                  \
      52             :   V(Map)                               \
      53             :   V(NativeContext)                     \
      54             :   V(Oddball)                           \
      55             :   V(PreparseData)                      \
      56             :   V(PropertyArray)                     \
      57             :   V(PropertyCell)                      \
      58             :   V(PrototypeInfo)                     \
      59             :   V(SeqOneByteString)                  \
      60             :   V(SeqTwoByteString)                  \
      61             :   V(SharedFunctionInfo)                \
      62             :   V(ShortcutCandidate)                 \
      63             :   V(SlicedString)                      \
      64             :   V(SmallOrderedHashMap)               \
      65             :   V(SmallOrderedHashSet)               \
      66             :   V(SmallOrderedNameDictionary)        \
      67             :   V(Struct)                            \
      68             :   V(Symbol)                            \
      69             :   V(ThinString)                        \
      70             :   V(TransitionArray)                   \
      71             :   V(UncompiledDataWithoutPreparseData) \
      72             :   V(UncompiledDataWithPreparseData)    \
      73             :   V(WasmInstanceObject)                \
      74             :   V(WeakArray)
      75             : 
      76             : // For data objects, JS objects and structs along with generic visitor which
      77             : // can visit object of any size we provide visitors specialized by
      78             : // object size in words.
      79             : // Ids of specialized visitors are declared in a linear order (without
      80             : // holes) starting from the id of visitor specialized for 2 words objects
      81             : // (base visitor id) and ending with the id of generic visitor.
      82             : // Method GetVisitorIdForSize depends on this ordering to calculate visitor
      83             : // id of specialized visitor from given instance size, base visitor id and
      84             : // generic visitor's id.
      85             : enum VisitorId {
      86             : #define VISITOR_ID_ENUM_DECL(id) kVisit##id,
      87             :   VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL)
      88             : #undef VISITOR_ID_ENUM_DECL
      89             :       kVisitorIdCount
      90             : };
      91             : 
      92             : typedef std::vector<Handle<Map>> MapHandles;
      93             : 
      94             : // All heap objects have a Map that describes their structure.
      95             : //  A Map contains information about:
      96             : //  - Size information about the object
      97             : //  - How to iterate over an object (for garbage collection)
      98             : //
      99             : // Map layout:
     100             : // +---------------+---------------------------------------------+
     101             : // |   _ Type _    | _ Description _                             |
     102             : // +---------------+---------------------------------------------+
     103             : // | TaggedPointer | map - Always a pointer to the MetaMap root  |
     104             : // +---------------+---------------------------------------------+
     105             : // | Int           | The first int field                         |
     106             : //  `---+----------+---------------------------------------------+
     107             : //      | Byte     | [instance_size]                             |
     108             : //      +----------+---------------------------------------------+
     109             : //      | Byte     | If Map for a primitive type:                |
     110             : //      |          |   native context index for constructor fn   |
     111             : //      |          | If Map for an Object type:                  |
     112             : //      |          |   inobject properties start offset in words |
     113             : //      +----------+---------------------------------------------+
     114             : //      | Byte     | [used_or_unused_instance_size_in_words]     |
     115             : //      |          | For JSObject in fast mode this byte encodes |
     116             : //      |          | the size of the object that includes only   |
     117             : //      |          | the used property fields or the slack size  |
     118             : //      |          | in properties backing store.                |
     119             : //      +----------+---------------------------------------------+
     120             : //      | Byte     | [visitor_id]                                |
     121             : // +----+----------+---------------------------------------------+
     122             : // | Int           | The second int field                        |
     123             : //  `---+----------+---------------------------------------------+
     124             : //      | Short    | [instance_type]                             |
     125             : //      +----------+---------------------------------------------+
     126             : //      | Byte     | [bit_field]                                 |
     127             : //      |          |   - has_non_instance_prototype (bit 0)      |
     128             : //      |          |   - is_callable (bit 1)                     |
     129             : //      |          |   - has_named_interceptor (bit 2)           |
     130             : //      |          |   - has_indexed_interceptor (bit 3)         |
     131             : //      |          |   - is_undetectable (bit 4)                 |
     132             : //      |          |   - is_access_check_needed (bit 5)          |
     133             : //      |          |   - is_constructor (bit 6)                  |
     134             : //      |          |   - has_prototype_slot (bit 7)              |
     135             : //      +----------+---------------------------------------------+
     136             : //      | Byte     | [bit_field2]                                |
     137             : //      |          |   - is_extensible (bit 0)                   |
     138             : //      |          |   - is_prototype_map (bit 1)                |
     139             : //      |          |   - is_in_retained_map_list (bit 2)         |
     140             : //      |          |   - elements_kind (bits 3..7)               |
     141             : // +----+----------+---------------------------------------------+
     142             : // | Int           | [bit_field3]                                |
     143             : // |               |   - enum_length (bit 0..9)                  |
     144             : // |               |   - number_of_own_descriptors (bit 10..19)  |
     145             : // |               |   - is_dictionary_map (bit 20)              |
     146             : // |               |   - owns_descriptors (bit 21)               |
     147             : // |               |   - has_hidden_prototype (bit 22)           |
     148             : // |               |   - is_deprecated (bit 23)                  |
     149             : // |               |   - is_unstable (bit 24)                    |
     150             : // |               |   - is_migration_target (bit 25)            |
     151             : // |               |   - is_immutable_proto (bit 26)             |
     152             : // |               |   - new_target_is_base (bit 27)             |
     153             : // |               |   - may_have_interesting_symbols (bit 28)   |
     154             : // |               |   - construction_counter (bit 29..31)       |
     155             : // |               |                                             |
     156             : // +*************************************************************+
     157             : // | Int           | On systems with 64bit pointer types, there  |
     158             : // |               | is an unused 32bits after bit_field3        |
     159             : // +*************************************************************+
     160             : // | TaggedPointer | [prototype]                                 |
     161             : // +---------------+---------------------------------------------+
     162             : // | TaggedPointer | [constructor_or_backpointer]                |
     163             : // +---------------+---------------------------------------------+
     164             : // | TaggedPointer | If Map is a prototype map:                  |
     165             : // |               |   [prototype_info]                          |
     166             : // |               | Else:                                       |
     167             : // |               |   [raw_transitions]                         |
     168             : // +---------------+---------------------------------------------+
     169             : // | TaggedPointer | [instance_descriptors]                      |
     170             : // +*************************************************************+
     171             : // ! TaggedPointer ! [layout_descriptors]                        !
     172             : // !               ! Field is only present if compile-time flag  !
     173             : // !               ! FLAG_unbox_double_fields is enabled         !
     174             : // !               ! (basically on 64 bit architectures)         !
     175             : // +*************************************************************+
     176             : // | TaggedPointer | [dependent_code]                            |
     177             : // +---------------+---------------------------------------------+
     178             : 
     179             : class Map : public HeapObject {
     180             :  public:
     181             :   // Instance size.
     182             :   // Size in bytes or kVariableSizeSentinel if instances do not have
     183             :   // a fixed size.
     184             :   DECL_INT_ACCESSORS(instance_size)
     185             :   // Size in words or kVariableSizeSentinel if instances do not have
     186             :   // a fixed size.
     187             :   DECL_INT_ACCESSORS(instance_size_in_words)
     188             : 
     189             :   // [inobject_properties_start_or_constructor_function_index]:
     190             :   // Provides access to the inobject properties start offset in words in case of
     191             :   // JSObject maps, or the constructor function index in case of primitive maps.
     192             :   DECL_INT_ACCESSORS(inobject_properties_start_or_constructor_function_index)
     193             : 
     194             :   // Get/set the in-object property area start offset in words in the object.
     195             :   inline int GetInObjectPropertiesStartInWords() const;
     196             :   inline void SetInObjectPropertiesStartInWords(int value);
     197             :   // Count of properties allocated in the object (JSObject only).
     198             :   inline int GetInObjectProperties() const;
     199             :   // Index of the constructor function in the native context (primitives only),
     200             :   // or the special sentinel value to indicate that there is no object wrapper
     201             :   // for the primitive (i.e. in case of null or undefined).
     202             :   static const int kNoConstructorFunctionIndex = 0;
     203             :   inline int GetConstructorFunctionIndex() const;
     204             :   inline void SetConstructorFunctionIndex(int value);
     205             :   static MaybeHandle<JSFunction> GetConstructorFunction(
     206             :       Handle<Map> map, Handle<Context> native_context);
     207             : 
     208             :   // Retrieve interceptors.
     209             :   inline InterceptorInfo GetNamedInterceptor();
     210             :   inline InterceptorInfo GetIndexedInterceptor();
     211             : 
     212             :   // Instance type.
     213             :   DECL_PRIMITIVE_ACCESSORS(instance_type, InstanceType)
     214             : 
     215             :   // Returns the size of the used in-object area including object header
     216             :   // (only used for JSObject in fast mode, for the other kinds of objects it
     217             :   // is equal to the instance size).
     218             :   inline int UsedInstanceSize() const;
     219             : 
     220             :   // Tells how many unused property fields (in-object or out-of object) are
     221             :   // available in the instance (only used for JSObject in fast mode).
     222             :   inline int UnusedPropertyFields() const;
     223             :   // Tells how many unused in-object property words are present.
     224             :   inline int UnusedInObjectProperties() const;
     225             :   // Updates the counters tracking unused fields in the object.
     226             :   inline void SetInObjectUnusedPropertyFields(int unused_property_fields);
     227             :   // Updates the counters tracking unused fields in the property array.
     228             :   inline void SetOutOfObjectUnusedPropertyFields(int unused_property_fields);
     229             :   inline void CopyUnusedPropertyFields(Map map);
     230             :   inline void CopyUnusedPropertyFieldsAdjustedForInstanceSize(Map map);
     231             :   inline void AccountAddedPropertyField();
     232             :   inline void AccountAddedOutOfObjectPropertyField(
     233             :       int unused_in_property_array);
     234             : 
     235             :   //
     236             :   // Bit field.
     237             :   //
     238             :   DECL_PRIMITIVE_ACCESSORS(bit_field, byte)
     239             : 
     240             : // Bit positions for |bit_field|.
     241             : #define MAP_BIT_FIELD_FIELDS(V, _)          \
     242             :   V(HasNonInstancePrototypeBit, bool, 1, _) \
     243             :   V(IsCallableBit, bool, 1, _)              \
     244             :   V(HasNamedInterceptorBit, bool, 1, _)     \
     245             :   V(HasIndexedInterceptorBit, bool, 1, _)   \
     246             :   V(IsUndetectableBit, bool, 1, _)          \
     247             :   V(IsAccessCheckNeededBit, bool, 1, _)     \
     248             :   V(IsConstructorBit, bool, 1, _)           \
     249             :   V(HasPrototypeSlotBit, bool, 1, _)
     250             : 
     251             :   DEFINE_BIT_FIELDS(MAP_BIT_FIELD_FIELDS)
     252             : #undef MAP_BIT_FIELD_FIELDS
     253             : 
     254             :   //
     255             :   // Bit field 2.
     256             :   //
     257             :   DECL_PRIMITIVE_ACCESSORS(bit_field2, byte)
     258             : 
     259             : // Bit positions for |bit_field2|.
     260             : #define MAP_BIT_FIELD2_FIELDS(V, _)     \
     261             :   V(IsExtensibleBit, bool, 1, _)        \
     262             :   V(IsPrototypeMapBit, bool, 1, _)      \
     263             :   V(IsInRetainedMapListBit, bool, 1, _) \
     264             :   V(ElementsKindBits, ElementsKind, 5, _)
     265             : 
     266             :   DEFINE_BIT_FIELDS(MAP_BIT_FIELD2_FIELDS)
     267             : #undef MAP_BIT_FIELD2_FIELDS
     268             : 
     269             :   //
     270             :   // Bit field 3.
     271             :   //
     272             :   DECL_PRIMITIVE_ACCESSORS(bit_field3, uint32_t)
     273             : 
     274             : // Bit positions for |bit_field3|.
     275             : #define MAP_BIT_FIELD3_FIELDS(V, _)                               \
     276             :   V(EnumLengthBits, int, kDescriptorIndexBitCount, _)             \
     277             :   V(NumberOfOwnDescriptorsBits, int, kDescriptorIndexBitCount, _) \
     278             :   V(IsDictionaryMapBit, bool, 1, _)                               \
     279             :   V(OwnsDescriptorsBit, bool, 1, _)                               \
     280             :   V(HasHiddenPrototypeBit, bool, 1, _)                            \
     281             :   V(IsDeprecatedBit, bool, 1, _)                                  \
     282             :   V(IsUnstableBit, bool, 1, _)                                    \
     283             :   V(IsMigrationTargetBit, bool, 1, _)                             \
     284             :   V(IsImmutablePrototypeBit, bool, 1, _)                          \
     285             :   V(NewTargetIsBaseBit, bool, 1, _)                               \
     286             :   V(MayHaveInterestingSymbolsBit, bool, 1, _)                     \
     287             :   V(ConstructionCounterBits, int, 3, _)
     288             : 
     289             :   DEFINE_BIT_FIELDS(MAP_BIT_FIELD3_FIELDS)
     290             : #undef MAP_BIT_FIELD3_FIELDS
     291             : 
     292             :   STATIC_ASSERT(NumberOfOwnDescriptorsBits::kMax >= kMaxNumberOfDescriptors);
     293             : 
     294             :   static const int kSlackTrackingCounterStart = 7;
     295             :   static const int kSlackTrackingCounterEnd = 1;
     296             :   static const int kNoSlackTracking = 0;
     297             :   STATIC_ASSERT(kSlackTrackingCounterStart <= ConstructionCounterBits::kMax);
     298             : 
     299             :   // Inobject slack tracking is the way to reclaim unused inobject space.
     300             :   //
     301             :   // The instance size is initially determined by adding some slack to
     302             :   // expected_nof_properties (to allow for a few extra properties added
     303             :   // after the constructor). There is no guarantee that the extra space
     304             :   // will not be wasted.
     305             :   //
     306             :   // Here is the algorithm to reclaim the unused inobject space:
     307             :   // - Detect the first constructor call for this JSFunction.
     308             :   //   When it happens enter the "in progress" state: initialize construction
     309             :   //   counter in the initial_map.
     310             :   // - While the tracking is in progress initialize unused properties of a new
     311             :   //   object with one_pointer_filler_map instead of undefined_value (the "used"
     312             :   //   part is initialized with undefined_value as usual). This way they can
     313             :   //   be resized quickly and safely.
     314             :   // - Once enough objects have been created  compute the 'slack'
     315             :   //   (traverse the map transition tree starting from the
     316             :   //   initial_map and find the lowest value of unused_property_fields).
     317             :   // - Traverse the transition tree again and decrease the instance size
     318             :   //   of every map. Existing objects will resize automatically (they are
     319             :   //   filled with one_pointer_filler_map). All further allocations will
     320             :   //   use the adjusted instance size.
     321             :   // - SharedFunctionInfo's expected_nof_properties left unmodified since
     322             :   //   allocations made using different closures could actually create different
     323             :   //   kind of objects (see prototype inheritance pattern).
     324             :   //
     325             :   //  Important: inobject slack tracking is not attempted during the snapshot
     326             :   //  creation.
     327             : 
     328             :   static const int kGenerousAllocationCount =
     329             :       kSlackTrackingCounterStart - kSlackTrackingCounterEnd + 1;
     330             : 
     331             :   // Starts the tracking by initializing object constructions countdown counter.
     332             :   void StartInobjectSlackTracking();
     333             : 
     334             :   // True if the object constructions countdown counter is a range
     335             :   // [kSlackTrackingCounterEnd, kSlackTrackingCounterStart].
     336             :   inline bool IsInobjectSlackTrackingInProgress() const;
     337             : 
     338             :   // Does the tracking step.
     339             :   inline void InobjectSlackTrackingStep(Isolate* isolate);
     340             : 
     341             :   // Computes inobject slack for the transition tree starting at this initial
     342             :   // map.
     343             :   int ComputeMinObjectSlack(Isolate* isolate);
     344             :   inline int InstanceSizeFromSlack(int slack) const;
     345             : 
     346             :   // Completes inobject slack tracking for the transition tree starting at this
     347             :   // initial map.
     348             :   void CompleteInobjectSlackTracking(Isolate* isolate);
     349             : 
     350             :   // Tells whether the object in the prototype property will be used
     351             :   // for instances created from this function.  If the prototype
     352             :   // property is set to a value that is not a JSObject, the prototype
     353             :   // property will not be used to create instances of the function.
     354             :   // See ECMA-262, 13.2.2.
     355             :   DECL_BOOLEAN_ACCESSORS(has_non_instance_prototype)
     356             : 
     357             :   // Tells whether the instance has a [[Construct]] internal method.
     358             :   // This property is implemented according to ES6, section 7.2.4.
     359             :   DECL_BOOLEAN_ACCESSORS(is_constructor)
     360             : 
     361             :   // Tells whether the instance with this map may have properties for
     362             :   // interesting symbols on it.
     363             :   // An "interesting symbol" is one for which Name::IsInterestingSymbol()
     364             :   // returns true, i.e. a well-known symbol like @@toStringTag.
     365             :   DECL_BOOLEAN_ACCESSORS(may_have_interesting_symbols)
     366             : 
     367             :   DECL_BOOLEAN_ACCESSORS(has_prototype_slot)
     368             : 
     369             :   // Tells whether the instance with this map has a hidden prototype.
     370             :   DECL_BOOLEAN_ACCESSORS(has_hidden_prototype)
     371             : 
     372             :   // Records and queries whether the instance has a named interceptor.
     373             :   DECL_BOOLEAN_ACCESSORS(has_named_interceptor)
     374             : 
     375             :   // Records and queries whether the instance has an indexed interceptor.
     376             :   DECL_BOOLEAN_ACCESSORS(has_indexed_interceptor)
     377             : 
     378             :   // Tells whether the instance is undetectable.
     379             :   // An undetectable object is a special class of JSObject: 'typeof' operator
     380             :   // returns undefined, ToBoolean returns false. Otherwise it behaves like
     381             :   // a normal JS object.  It is useful for implementing undetectable
     382             :   // document.all in Firefox & Safari.
     383             :   // See https://bugzilla.mozilla.org/show_bug.cgi?id=248549.
     384             :   DECL_BOOLEAN_ACCESSORS(is_undetectable)
     385             : 
     386             :   // Tells whether the instance has a [[Call]] internal method.
     387             :   // This property is implemented according to ES6, section 7.2.3.
     388             :   DECL_BOOLEAN_ACCESSORS(is_callable)
     389             : 
     390             :   DECL_BOOLEAN_ACCESSORS(new_target_is_base)
     391             :   DECL_BOOLEAN_ACCESSORS(is_extensible)
     392             :   DECL_BOOLEAN_ACCESSORS(is_prototype_map)
     393             :   inline bool is_abandoned_prototype_map() const;
     394             : 
     395             :   // Whether the instance has been added to the retained map list by
     396             :   // Heap::AddRetainedMap.
     397             :   DECL_BOOLEAN_ACCESSORS(is_in_retained_map_list)
     398             : 
     399             :   DECL_PRIMITIVE_ACCESSORS(elements_kind, ElementsKind)
     400             : 
     401             :   // Tells whether the instance has fast elements that are only Smis.
     402             :   inline bool has_fast_smi_elements() const;
     403             : 
     404             :   // Tells whether the instance has fast elements.
     405             :   inline bool has_fast_object_elements() const;
     406             :   inline bool has_fast_smi_or_object_elements() const;
     407             :   inline bool has_fast_double_elements() const;
     408             :   inline bool has_fast_elements() const;
     409             :   inline bool has_sloppy_arguments_elements() const;
     410             :   inline bool has_fast_sloppy_arguments_elements() const;
     411             :   inline bool has_fast_string_wrapper_elements() const;
     412             :   inline bool has_fixed_typed_array_elements() const;
     413             :   inline bool has_dictionary_elements() const;
     414             : 
     415             :   // Returns true if the current map doesn't have DICTIONARY_ELEMENTS but if a
     416             :   // map with DICTIONARY_ELEMENTS was found in the prototype chain.
     417             :   bool DictionaryElementsInPrototypeChainOnly(Isolate* isolate);
     418             : 
     419             :   inline Map ElementsTransitionMap();
     420             : 
     421             :   inline FixedArrayBase GetInitialElements() const;
     422             : 
     423             :   // [raw_transitions]: Provides access to the transitions storage field.
     424             :   // Don't call set_raw_transitions() directly to overwrite transitions, use
     425             :   // the TransitionArray::ReplaceTransitions() wrapper instead!
     426             :   DECL_ACCESSORS(raw_transitions, MaybeObject)
     427             :   // [prototype_info]: Per-prototype metadata. Aliased with transitions
     428             :   // (which prototype maps don't have).
     429             :   DECL_ACCESSORS(prototype_info, Object)
     430             :   // PrototypeInfo is created lazily using this helper (which installs it on
     431             :   // the given prototype's map).
     432             :   static Handle<PrototypeInfo> GetOrCreatePrototypeInfo(
     433             :       Handle<JSObject> prototype, Isolate* isolate);
     434             :   static Handle<PrototypeInfo> GetOrCreatePrototypeInfo(
     435             :       Handle<Map> prototype_map, Isolate* isolate);
     436             :   inline bool should_be_fast_prototype_map() const;
     437             :   static void SetShouldBeFastPrototypeMap(Handle<Map> map, bool value,
     438             :                                           Isolate* isolate);
     439             : 
     440             :   // [prototype chain validity cell]: Associated with a prototype object,
     441             :   // stored in that object's map, indicates that prototype chains through this
     442             :   // object are currently valid. The cell will be invalidated and replaced when
     443             :   // the prototype chain changes. When there's nothing to guard (for example,
     444             :   // when direct prototype is null or Proxy) this function returns Smi with
     445             :   // |kPrototypeChainValid| sentinel value.
     446             :   static Handle<Object> GetOrCreatePrototypeChainValidityCell(Handle<Map> map,
     447             :                                                               Isolate* isolate);
     448             :   static const int kPrototypeChainValid = 0;
     449             :   static const int kPrototypeChainInvalid = 1;
     450             : 
     451             :   static bool IsPrototypeChainInvalidated(Map map);
     452             : 
     453             :   // Return the map of the root of object's prototype chain.
     454             :   Map GetPrototypeChainRootMap(Isolate* isolate) const;
     455             : 
     456             :   Map FindRootMap(Isolate* isolate) const;
     457             :   Map FindFieldOwner(Isolate* isolate, int descriptor) const;
     458             : 
     459             :   inline int GetInObjectPropertyOffset(int index) const;
     460             : 
     461             :   class FieldCounts {
     462             :    public:
     463             :     FieldCounts(int mutable_count, int const_count)
     464             :         : mutable_count_(mutable_count), const_count_(const_count) {}
     465             : 
     466     2596814 :     int GetTotal() const { return mutable_count() + const_count(); }
     467             : 
     468             :     int mutable_count() const { return mutable_count_; }
     469             :     int const_count() const { return const_count_; }
     470             : 
     471             :    private:
     472             :     int mutable_count_;
     473             :     int const_count_;
     474             :   };
     475             : 
     476             :   FieldCounts GetFieldCounts() const;
     477             :   int NumberOfFields() const;
     478             : 
     479             :   bool HasOutOfObjectProperties() const;
     480             : 
     481             :   // Returns true if transition to the given map requires special
     482             :   // synchronization with the concurrent marker.
     483             :   bool TransitionRequiresSynchronizationWithGC(Map target) const;
     484             :   // Returns true if transition to the given map removes a tagged in-object
     485             :   // field.
     486             :   bool TransitionRemovesTaggedField(Map target) const;
     487             :   // Returns true if transition to the given map replaces a tagged in-object
     488             :   // field with an untagged in-object field.
     489             :   bool TransitionChangesTaggedFieldToUntaggedField(Map target) const;
     490             : 
     491             :   // TODO(ishell): candidate with JSObject::MigrateToMap().
     492             :   bool InstancesNeedRewriting(Map target) const;
     493             :   bool InstancesNeedRewriting(Map target, int target_number_of_fields,
     494             :                               int target_inobject, int target_unused,
     495             :                               int* old_number_of_fields) const;
     496             :   V8_WARN_UNUSED_RESULT static Handle<FieldType> GeneralizeFieldType(
     497             :       Representation rep1, Handle<FieldType> type1, Representation rep2,
     498             :       Handle<FieldType> type2, Isolate* isolate);
     499             :   static void GeneralizeField(Isolate* isolate, Handle<Map> map,
     500             :                               int modify_index, PropertyConstness new_constness,
     501             :                               Representation new_representation,
     502             :                               Handle<FieldType> new_field_type);
     503             :   // Returns true if |descriptor|'th property is a field that may be generalized
     504             :   // by just updating current map.
     505             :   static inline bool IsInplaceGeneralizableField(PropertyConstness constness,
     506             :                                                  Representation representation,
     507             :                                                  FieldType field_type);
     508             : 
     509             :   // Generalizes constness, representation and field_type if objects with given
     510             :   // instance type can have fast elements that can be transitioned by stubs or
     511             :   // optimized code to more general elements kind.
     512             :   // This generalization is necessary in order to ensure that elements kind
     513             :   // transitions performed by stubs / optimized code don't silently transition
     514             :   // PropertyConstness::kMutable fields back to VariableMode::kConst state or
     515             :   // fields with HeapObject representation and "Any" type back to "Class" type.
     516             :   static inline void GeneralizeIfCanHaveTransitionableFastElementsKind(
     517             :       Isolate* isolate, InstanceType instance_type,
     518             :       PropertyConstness* constness, Representation* representation,
     519             :       Handle<FieldType>* field_type);
     520             : 
     521             :   static Handle<Map> ReconfigureProperty(Isolate* isolate, Handle<Map> map,
     522             :                                          int modify_index,
     523             :                                          PropertyKind new_kind,
     524             :                                          PropertyAttributes new_attributes,
     525             :                                          Representation new_representation,
     526             :                                          Handle<FieldType> new_field_type);
     527             : 
     528             :   static Handle<Map> ReconfigureElementsKind(Isolate* isolate, Handle<Map> map,
     529             :                                              ElementsKind new_elements_kind);
     530             : 
     531             :   static Handle<Map> PrepareForDataProperty(Isolate* isolate,
     532             :                                             Handle<Map> old_map,
     533             :                                             int descriptor_number,
     534             :                                             PropertyConstness constness,
     535             :                                             Handle<Object> value);
     536             : 
     537             :   static Handle<Map> Normalize(Isolate* isolate, Handle<Map> map,
     538             :                                PropertyNormalizationMode mode,
     539             :                                const char* reason);
     540             : 
     541             :   // Tells whether the map is used for JSObjects in dictionary mode (ie
     542             :   // normalized objects, ie objects for which HasFastProperties returns false).
     543             :   // A map can never be used for both dictionary mode and fast mode JSObjects.
     544             :   // False by default and for HeapObjects that are not JSObjects.
     545             :   DECL_BOOLEAN_ACCESSORS(is_dictionary_map)
     546             : 
     547             :   // Tells whether the instance needs security checks when accessing its
     548             :   // properties.
     549             :   DECL_BOOLEAN_ACCESSORS(is_access_check_needed)
     550             : 
     551             :   // [prototype]: implicit prototype object.
     552             :   DECL_ACCESSORS(prototype, Object)
     553             :   // TODO(jkummerow): make set_prototype private.
     554             :   static void SetPrototype(Isolate* isolate, Handle<Map> map,
     555             :                            Handle<Object> prototype,
     556             :                            bool enable_prototype_setup_mode = true);
     557             : 
     558             :   // [constructor]: points back to the function or FunctionTemplateInfo
     559             :   // responsible for this map.
     560             :   // The field overlaps with the back pointer. All maps in a transition tree
     561             :   // have the same constructor, so maps with back pointers can walk the
     562             :   // back pointer chain until they find the map holding their constructor.
     563             :   // Returns null_value if there's neither a constructor function nor a
     564             :   // FunctionTemplateInfo available.
     565             :   DECL_ACCESSORS(constructor_or_backpointer, Object)
     566             :   inline Object GetConstructor() const;
     567             :   inline FunctionTemplateInfo GetFunctionTemplateInfo() const;
     568             :   inline void SetConstructor(Object constructor,
     569             :                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
     570             :   // [back pointer]: points back to the parent map from which a transition
     571             :   // leads to this map. The field overlaps with the constructor (see above).
     572             :   inline Object GetBackPointer() const;
     573             :   inline void SetBackPointer(Object value,
     574             :                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
     575             : 
     576             :   // [instance descriptors]: describes the object.
     577             :   inline DescriptorArray instance_descriptors() const;
     578             :   inline DescriptorArray synchronized_instance_descriptors() const;
     579             :   void SetInstanceDescriptors(Isolate* isolate, DescriptorArray descriptors,
     580             :                               int number_of_own_descriptors);
     581             : 
     582             :   // [layout descriptor]: describes the object layout.
     583             :   DECL_ACCESSORS(layout_descriptor, LayoutDescriptor)
     584             :   // |layout descriptor| accessor which can be used from GC.
     585             :   inline LayoutDescriptor layout_descriptor_gc_safe() const;
     586             :   inline bool HasFastPointerLayout() const;
     587             : 
     588             :   // |layout descriptor| accessor that is safe to call even when
     589             :   // FLAG_unbox_double_fields is disabled (in this case Map does not contain
     590             :   // |layout_descriptor| field at all).
     591             :   inline LayoutDescriptor GetLayoutDescriptor() const;
     592             : 
     593             :   inline void UpdateDescriptors(Isolate* isolate, DescriptorArray descriptors,
     594             :                                 LayoutDescriptor layout_descriptor,
     595             :                                 int number_of_own_descriptors);
     596             :   inline void InitializeDescriptors(Isolate* isolate,
     597             :                                     DescriptorArray descriptors,
     598             :                                     LayoutDescriptor layout_descriptor);
     599             : 
     600             :   // [dependent code]: list of optimized codes that weakly embed this map.
     601             :   DECL_ACCESSORS(dependent_code, DependentCode)
     602             : 
     603             :   // [prototype_validity_cell]: Cell containing the validity bit for prototype
     604             :   // chains or Smi(0) if uninitialized.
     605             :   // The meaning of this validity cell is different for prototype maps and
     606             :   // non-prototype maps.
     607             :   // For prototype maps the validity bit "guards" modifications of prototype
     608             :   // chains going through this object. When a prototype object changes, both its
     609             :   // own validity cell and those of all "downstream" prototypes are invalidated;
     610             :   // handlers for a given receiver embed the currently valid cell for that
     611             :   // receiver's prototype during their creation and check it on execution.
     612             :   // For non-prototype maps which are used as transitioning store handlers this
     613             :   // field contains the validity cell which guards modifications of this map's
     614             :   // prototype.
     615             :   DECL_ACCESSORS(prototype_validity_cell, Object)
     616             : 
     617             :   // Returns true if prototype validity cell value represents "valid" prototype
     618             :   // chain state.
     619             :   inline bool IsPrototypeValidityCellValid() const;
     620             : 
     621             :   inline PropertyDetails GetLastDescriptorDetails() const;
     622             : 
     623             :   inline int LastAdded() const;
     624             : 
     625             :   inline int NumberOfOwnDescriptors() const;
     626             :   inline void SetNumberOfOwnDescriptors(int number);
     627             : 
     628             :   inline Cell RetrieveDescriptorsPointer();
     629             : 
     630             :   // Checks whether all properties are stored either in the map or on the object
     631             :   // (inobject, properties, or elements backing store), requiring no special
     632             :   // checks.
     633             :   bool OnlyHasSimpleProperties() const;
     634             :   inline int EnumLength() const;
     635             :   inline void SetEnumLength(int length);
     636             : 
     637             :   DECL_BOOLEAN_ACCESSORS(owns_descriptors)
     638             : 
     639             :   inline void mark_unstable();
     640             :   inline bool is_stable() const;
     641             : 
     642             :   DECL_BOOLEAN_ACCESSORS(is_migration_target)
     643             : 
     644             :   DECL_BOOLEAN_ACCESSORS(is_immutable_proto)
     645             : 
     646             :   // This counter is used for in-object slack tracking.
     647             :   // The in-object slack tracking is considered enabled when the counter is
     648             :   // non zero. The counter only has a valid count for initial maps. For
     649             :   // transitioned maps only kNoSlackTracking has a meaning, namely that inobject
     650             :   // slack tracking already finished for the transition tree. Any other value
     651             :   // indicates that either inobject slack tracking is still in progress, or that
     652             :   // the map isn't part of the transition tree anymore.
     653             :   DECL_INT_ACCESSORS(construction_counter)
     654             : 
     655             :   DECL_BOOLEAN_ACCESSORS(is_deprecated)
     656             :   inline bool CanBeDeprecated() const;
     657             :   // Returns a non-deprecated version of the input. If the input was not
     658             :   // deprecated, it is directly returned. Otherwise, the non-deprecated version
     659             :   // is found by re-transitioning from the root of the transition tree using the
     660             :   // descriptor array of the map. Returns MaybeHandle<Map>() if no updated map
     661             :   // is found.
     662             :   static MaybeHandle<Map> TryUpdate(Isolate* isolate,
     663             :                                     Handle<Map> map) V8_WARN_UNUSED_RESULT;
     664             :   static Map TryUpdateSlow(Isolate* isolate, Map map) V8_WARN_UNUSED_RESULT;
     665             : 
     666             :   // Returns a non-deprecated version of the input. This method may deprecate
     667             :   // existing maps along the way if encodings conflict. Not for use while
     668             :   // gathering type feedback. Use TryUpdate in those cases instead.
     669             :   static Handle<Map> Update(Isolate* isolate, Handle<Map> map);
     670             : 
     671             :   static inline Handle<Map> CopyInitialMap(Isolate* isolate, Handle<Map> map);
     672             :   static Handle<Map> CopyInitialMap(Isolate* isolate, Handle<Map> map,
     673             :                                     int instance_size, int in_object_properties,
     674             :                                     int unused_property_fields);
     675             :   static Handle<Map> CopyInitialMapNormalized(
     676             :       Isolate* isolate, Handle<Map> map,
     677             :       PropertyNormalizationMode mode = CLEAR_INOBJECT_PROPERTIES);
     678             :   static Handle<Map> CopyDropDescriptors(Isolate* isolate, Handle<Map> map);
     679             :   static Handle<Map> CopyInsertDescriptor(Isolate* isolate, Handle<Map> map,
     680             :                                           Descriptor* descriptor,
     681             :                                           TransitionFlag flag);
     682             : 
     683             :   static MaybeObjectHandle WrapFieldType(Isolate* isolate,
     684             :                                          Handle<FieldType> type);
     685             :   static FieldType UnwrapFieldType(MaybeObject wrapped_type);
     686             : 
     687             :   V8_WARN_UNUSED_RESULT static MaybeHandle<Map> CopyWithField(
     688             :       Isolate* isolate, Handle<Map> map, Handle<Name> name,
     689             :       Handle<FieldType> type, PropertyAttributes attributes,
     690             :       PropertyConstness constness, Representation representation,
     691             :       TransitionFlag flag);
     692             : 
     693             :   V8_WARN_UNUSED_RESULT static MaybeHandle<Map> CopyWithConstant(
     694             :       Isolate* isolate, Handle<Map> map, Handle<Name> name,
     695             :       Handle<Object> constant, PropertyAttributes attributes,
     696             :       TransitionFlag flag);
     697             : 
     698             :   // Returns a new map with all transitions dropped from the given map and
     699             :   // the ElementsKind set.
     700             :   static Handle<Map> TransitionElementsTo(Isolate* isolate, Handle<Map> map,
     701             :                                           ElementsKind to_kind);
     702             : 
     703             :   static Handle<Map> AsElementsKind(Isolate* isolate, Handle<Map> map,
     704             :                                     ElementsKind kind);
     705             : 
     706             :   static Handle<Map> CopyAsElementsKind(Isolate* isolate, Handle<Map> map,
     707             :                                         ElementsKind kind, TransitionFlag flag);
     708             : 
     709             :   static Handle<Map> AsLanguageMode(Isolate* isolate, Handle<Map> initial_map,
     710             :                                     Handle<SharedFunctionInfo> shared_info);
     711             : 
     712             :   static Handle<Map> CopyForPreventExtensions(Isolate* isolate, Handle<Map> map,
     713             :                                               PropertyAttributes attrs_to_add,
     714             :                                               Handle<Symbol> transition_marker,
     715             :                                               const char* reason);
     716             : 
     717             :   static Handle<Map> FixProxy(Handle<Map> map, InstanceType type, int size);
     718             : 
     719             :   // Maximal number of fast properties. Used to restrict the number of map
     720             :   // transitions to avoid an explosion in the number of maps for objects used as
     721             :   // dictionaries.
     722             :   inline bool TooManyFastProperties(StoreOrigin store_origin) const;
     723             :   static Handle<Map> TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
     724             :                                               Handle<Name> name,
     725             :                                               Handle<Object> value,
     726             :                                               PropertyAttributes attributes,
     727             :                                               PropertyConstness constness,
     728             :                                               StoreOrigin store_origin);
     729             :   static Handle<Map> TransitionToAccessorProperty(
     730             :       Isolate* isolate, Handle<Map> map, Handle<Name> name, int descriptor,
     731             :       Handle<Object> getter, Handle<Object> setter,
     732             :       PropertyAttributes attributes);
     733             :   static Handle<Map> ReconfigureExistingProperty(Isolate* isolate,
     734             :                                                  Handle<Map> map,
     735             :                                                  int descriptor,
     736             :                                                  PropertyKind kind,
     737             :                                                  PropertyAttributes attributes);
     738             : 
     739             :   inline void AppendDescriptor(Isolate* isolate, Descriptor* desc);
     740             : 
     741             :   // Returns a copy of the map, prepared for inserting into the transition
     742             :   // tree (if the |map| owns descriptors then the new one will share
     743             :   // descriptors with |map|).
     744             :   static Handle<Map> CopyForElementsTransition(Isolate* isolate,
     745             :                                                Handle<Map> map);
     746             : 
     747             :   // Returns a copy of the map, with all transitions dropped from the
     748             :   // instance descriptors.
     749             :   static Handle<Map> Copy(Isolate* isolate, Handle<Map> map,
     750             :                           const char* reason);
     751             :   static Handle<Map> Create(Isolate* isolate, int inobject_properties);
     752             : 
     753             :   // Returns the next free property index (only valid for FAST MODE).
     754             :   int NextFreePropertyIndex() const;
     755             : 
     756             :   // Returns the number of enumerable properties.
     757             :   int NumberOfEnumerableProperties() const;
     758             : 
     759             :   DECL_CAST(Map)
     760             : 
     761             :   static inline int SlackForArraySize(int old_size, int size_limit);
     762             : 
     763             :   static void EnsureDescriptorSlack(Isolate* isolate, Handle<Map> map,
     764             :                                     int slack);
     765             : 
     766             :   // Returns the map to be used for instances when the given {prototype} is
     767             :   // passed to an Object.create call. Might transition the given {prototype}.
     768             :   static Handle<Map> GetObjectCreateMap(Isolate* isolate,
     769             :                                         Handle<HeapObject> prototype);
     770             : 
     771             :   // Similar to {GetObjectCreateMap} but does not transition {prototype} and
     772             :   // fails gracefully by returning an empty handle instead.
     773             :   static MaybeHandle<Map> TryGetObjectCreateMap(Isolate* isolate,
     774             :                                                 Handle<HeapObject> prototype);
     775             : 
     776             :   // Computes a hash value for this map, to be used in HashTables and such.
     777             :   int Hash();
     778             : 
     779             :   // Returns the transitioned map for this map with the most generic
     780             :   // elements_kind that's found in |candidates|, or |nullptr| if no match is
     781             :   // found at all.
     782             :   Map FindElementsKindTransitionedMap(Isolate* isolate,
     783             :                                       MapHandles const& candidates);
     784             : 
     785             :   inline bool CanTransition() const;
     786             : 
     787             : #define DECL_TESTER(Type, ...) inline bool Is##Type##Map() const;
     788             :   INSTANCE_TYPE_CHECKERS(DECL_TESTER)
     789             : #undef DECL_TESTER
     790             :   inline bool IsBooleanMap() const;
     791             :   inline bool IsNullOrUndefinedMap() const;
     792             :   inline bool IsPrimitiveMap() const;
     793             :   inline bool IsSpecialReceiverMap() const;
     794             :   inline bool IsCustomElementsReceiverMap() const;
     795             : 
     796             :   bool IsMapInArrayPrototypeChain(Isolate* isolate) const;
     797             : 
     798             :   // Dispatched behavior.
     799             :   void MapPrint(std::ostream& os);
     800             :   DECL_VERIFIER(Map)
     801             : 
     802             : #ifdef VERIFY_HEAP
     803             :   void DictionaryMapVerify(Isolate* isolate);
     804             : #endif
     805             : 
     806             :   DECL_PRIMITIVE_ACCESSORS(visitor_id, VisitorId)
     807             : 
     808             :   static Handle<Map> TransitionToPrototype(Isolate* isolate, Handle<Map> map,
     809             :                                            Handle<Object> prototype);
     810             : 
     811             :   static Handle<Map> TransitionToImmutableProto(Isolate* isolate,
     812             :                                                 Handle<Map> map);
     813             : 
     814             :   static const int kMaxPreAllocatedPropertyFields = 255;
     815             : 
     816             :   // Layout description.
     817             : #define MAP_FIELDS(V)                                                     \
     818             :   /* Raw data fields. */                                                  \
     819             :   V(kInstanceSizeInWordsOffset, kUInt8Size)                               \
     820             :   V(kInObjectPropertiesStartOrConstructorFunctionIndexOffset, kUInt8Size) \
     821             :   V(kUsedOrUnusedInstanceSizeInWordsOffset, kUInt8Size)                   \
     822             :   V(kVisitorIdOffset, kUInt8Size)                                         \
     823             :   V(kInstanceTypeOffset, kUInt16Size)                                     \
     824             :   V(kBitFieldOffset, kUInt8Size)                                          \
     825             :   V(kBitField2Offset, kUInt8Size)                                         \
     826             :   V(kBitField3Offset, kUInt32Size)                                        \
     827             :   V(k64BitArchPaddingOffset,                                              \
     828             :     kSystemPointerSize == kUInt32Size ? 0 : kUInt32Size)                  \
     829             :   /* Pointer fields. */                                                   \
     830             :   V(kPointerFieldsBeginOffset, 0)                                         \
     831             :   V(kPrototypeOffset, kTaggedSize)                                        \
     832             :   V(kConstructorOrBackPointerOffset, kTaggedSize)                         \
     833             :   V(kTransitionsOrPrototypeInfoOffset, kTaggedSize)                       \
     834             :   V(kDescriptorsOffset, kTaggedSize)                                      \
     835             :   V(kLayoutDescriptorOffset, FLAG_unbox_double_fields ? kTaggedSize : 0)  \
     836             :   V(kDependentCodeOffset, kTaggedSize)                                    \
     837             :   V(kPrototypeValidityCellOffset, kTaggedSize)                            \
     838             :   V(kPointerFieldsEndOffset, 0)                                           \
     839             :   /* Total size. */                                                       \
     840             :   V(kSize, 0)
     841             : 
     842             :   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, MAP_FIELDS)
     843             : #undef MAP_FIELDS
     844             : 
     845             :   STATIC_ASSERT(kInstanceTypeOffset == Internals::kMapInstanceTypeOffset);
     846             : 
     847             :   class BodyDescriptor;
     848             : 
     849             :   // Compares this map to another to see if they describe equivalent objects.
     850             :   // If |mode| is set to CLEAR_INOBJECT_PROPERTIES, |other| is treated as if
     851             :   // it had exactly zero inobject properties.
     852             :   // The "shared" flags of both this map and |other| are ignored.
     853             :   bool EquivalentToForNormalization(const Map other,
     854             :                                     PropertyNormalizationMode mode) const;
     855             : 
     856             :   // Returns true if given field is unboxed double.
     857             :   inline bool IsUnboxedDoubleField(FieldIndex index) const;
     858             : 
     859             :   void PrintMapDetails(std::ostream& os);
     860             : 
     861             :   static inline Handle<Map> AddMissingTransitionsForTesting(
     862             :       Isolate* isolate, Handle<Map> split_map,
     863             :       Handle<DescriptorArray> descriptors,
     864             :       Handle<LayoutDescriptor> full_layout_descriptor);
     865             : 
     866             :   // Fires when the layout of an object with a leaf map changes.
     867             :   // This includes adding transitions to the leaf map or changing
     868             :   // the descriptor array.
     869             :   inline void NotifyLeafMapLayoutChange(Isolate* isolate);
     870             : 
     871             :   static VisitorId GetVisitorId(Map map);
     872             : 
     873             :   // Returns true if objects with given instance type are allowed to have
     874             :   // fast transitionable elements kinds. This predicate is used to ensure
     875             :   // that objects that can have transitionable fast elements kind will not
     876             :   // get in-place generalizable fields because the elements kind transition
     877             :   // performed by stubs or optimized code can't properly generalize such
     878             :   // fields.
     879             :   static inline bool CanHaveFastTransitionableElementsKind(
     880             :       InstanceType instance_type);
     881             :   inline bool CanHaveFastTransitionableElementsKind() const;
     882             : 
     883             :  private:
     884             :   // This byte encodes either the instance size without the in-object slack or
     885             :   // the slack size in properties backing store.
     886             :   // Let H be JSObject::kHeaderSize / kTaggedSize.
     887             :   // If value >= H then:
     888             :   //     - all field properties are stored in the object.
     889             :   //     - there is no property array.
     890             :   //     - value * kTaggedSize is the actual object size without the slack.
     891             :   // Otherwise:
     892             :   //     - there is no slack in the object.
     893             :   //     - the property array has value slack slots.
     894             :   // Note that this encoding requires that H = JSObject::kFieldsAdded.
     895             :   DECL_INT_ACCESSORS(used_or_unused_instance_size_in_words)
     896             : 
     897             :   // Returns the map that this (root) map transitions to if its elements_kind
     898             :   // is changed to |elements_kind|, or |nullptr| if no such map is cached yet.
     899             :   Map LookupElementsTransitionMap(Isolate* isolate, ElementsKind elements_kind);
     900             : 
     901             :   // Tries to replay property transitions starting from this (root) map using
     902             :   // the descriptor array of the |map|. The |root_map| is expected to have
     903             :   // proper elements kind and therefore elements kinds transitions are not
     904             :   // taken by this function. Returns |nullptr| if matching transition map is
     905             :   // not found.
     906             :   Map TryReplayPropertyTransitions(Isolate* isolate, Map map);
     907             : 
     908             :   static void ConnectTransition(Isolate* isolate, Handle<Map> parent,
     909             :                                 Handle<Map> child, Handle<Name> name,
     910             :                                 SimpleTransitionFlag flag);
     911             : 
     912             :   bool EquivalentToForTransition(const Map other) const;
     913             :   bool EquivalentToForElementsKindTransition(const Map other) const;
     914             :   static Handle<Map> RawCopy(Isolate* isolate, Handle<Map> map,
     915             :                              int instance_size, int inobject_properties);
     916             :   static Handle<Map> ShareDescriptor(Isolate* isolate, Handle<Map> map,
     917             :                                      Handle<DescriptorArray> descriptors,
     918             :                                      Descriptor* descriptor);
     919             :   static Handle<Map> AddMissingTransitions(
     920             :       Isolate* isolate, Handle<Map> map, Handle<DescriptorArray> descriptors,
     921             :       Handle<LayoutDescriptor> full_layout_descriptor);
     922             :   static void InstallDescriptors(
     923             :       Isolate* isolate, Handle<Map> parent_map, Handle<Map> child_map,
     924             :       int new_descriptor, Handle<DescriptorArray> descriptors,
     925             :       Handle<LayoutDescriptor> full_layout_descriptor);
     926             :   static Handle<Map> CopyAddDescriptor(Isolate* isolate, Handle<Map> map,
     927             :                                        Descriptor* descriptor,
     928             :                                        TransitionFlag flag);
     929             :   static Handle<Map> CopyReplaceDescriptors(
     930             :       Isolate* isolate, Handle<Map> map, Handle<DescriptorArray> descriptors,
     931             :       Handle<LayoutDescriptor> layout_descriptor, TransitionFlag flag,
     932             :       MaybeHandle<Name> maybe_name, const char* reason,
     933             :       SimpleTransitionFlag simple_flag);
     934             : 
     935             :   static Handle<Map> CopyReplaceDescriptor(Isolate* isolate, Handle<Map> map,
     936             :                                            Handle<DescriptorArray> descriptors,
     937             :                                            Descriptor* descriptor, int index,
     938             :                                            TransitionFlag flag);
     939             :   static Handle<Map> CopyNormalized(Isolate* isolate, Handle<Map> map,
     940             :                                     PropertyNormalizationMode mode);
     941             : 
     942             :   // TODO(ishell): Move to MapUpdater.
     943             :   static Handle<Map> CopyGeneralizeAllFields(Isolate* isolate, Handle<Map> map,
     944             :                                              ElementsKind elements_kind,
     945             :                                              int modify_index,
     946             :                                              PropertyKind kind,
     947             :                                              PropertyAttributes attributes,
     948             :                                              const char* reason);
     949             : 
     950             :   void DeprecateTransitionTree(Isolate* isolate);
     951             : 
     952             :   void ReplaceDescriptors(Isolate* isolate, DescriptorArray new_descriptors,
     953             :                           LayoutDescriptor new_layout_descriptor);
     954             : 
     955             :   // Update field type of the given descriptor to new representation and new
     956             :   // type. The type must be prepared for storing in descriptor array:
     957             :   // it must be either a simple type or a map wrapped in a weak cell.
     958             :   void UpdateFieldType(Isolate* isolate, int descriptor_number,
     959             :                        Handle<Name> name, PropertyConstness new_constness,
     960             :                        Representation new_representation,
     961             :                        const MaybeObjectHandle& new_wrapped_type);
     962             : 
     963             :   // TODO(ishell): Move to MapUpdater.
     964             :   void PrintReconfiguration(Isolate* isolate, FILE* file, int modify_index,
     965             :                             PropertyKind kind, PropertyAttributes attributes);
     966             :   // TODO(ishell): Move to MapUpdater.
     967             :   void PrintGeneralization(
     968             :       Isolate* isolate, FILE* file, const char* reason, int modify_index,
     969             :       int split, int descriptors, bool constant_to_field,
     970             :       Representation old_representation, Representation new_representation,
     971             :       MaybeHandle<FieldType> old_field_type, MaybeHandle<Object> old_value,
     972             :       MaybeHandle<FieldType> new_field_type, MaybeHandle<Object> new_value);
     973             : 
     974             :   // Use the high-level instance_descriptors/SetInstanceDescriptors instead.
     975             :   inline void set_synchronized_instance_descriptors(
     976             :       DescriptorArray array, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
     977             : 
     978             :   static const int kFastPropertiesSoftLimit = 12;
     979             :   static const int kMaxFastProperties = 128;
     980             : 
     981             :   friend class MapUpdater;
     982             : 
     983 12320148367 :   OBJECT_CONSTRUCTORS(Map, HeapObject);
     984             : };
     985             : 
     986             : // The cache for maps used by normalized (dictionary mode) objects.
     987             : // Such maps do not have property descriptors, so a typical program
     988             : // needs very limited number of distinct normalized maps.
     989             : class NormalizedMapCache : public WeakFixedArray {
     990             :  public:
     991             :   NEVER_READ_ONLY_SPACE
     992             :   static Handle<NormalizedMapCache> New(Isolate* isolate);
     993             : 
     994             :   V8_WARN_UNUSED_RESULT MaybeHandle<Map> Get(Handle<Map> fast_map,
     995             :                                              PropertyNormalizationMode mode);
     996             :   void Set(Handle<Map> fast_map, Handle<Map> normalized_map);
     997             : 
     998             :   DECL_CAST(NormalizedMapCache)
     999             : 
    1000             :   static inline bool IsNormalizedMapCache(const HeapObject obj);
    1001             : 
    1002             :   DECL_VERIFIER(NormalizedMapCache)
    1003             : 
    1004             :  private:
    1005             :   static const int kEntries = 64;
    1006             : 
    1007             :   static inline int GetIndex(Handle<Map> map);
    1008             : 
    1009             :   // The following declarations hide base class methods.
    1010             :   Object get(int index);
    1011             :   void set(int index, Object value);
    1012             : 
    1013             :   OBJECT_CONSTRUCTORS(NormalizedMapCache, WeakFixedArray)
    1014             : };
    1015             : 
    1016             : }  // namespace internal
    1017             : }  // namespace v8
    1018             : 
    1019             : #include "src/objects/object-macros-undef.h"
    1020             : 
    1021             : #endif  // V8_OBJECTS_MAP_H_

Generated by: LCOV version 1.10