LCOV - code coverage report
Current view: top level - src/objects - map.h (source / functions) Hit Total Coverage
Test: app.info Lines: 3 3 100.0 %
Date: 2019-03-21 Functions: 1 1 100.0 %

          Line data    Source code
       1             : // Copyright 2017 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #ifndef V8_OBJECTS_MAP_H_
       6             : #define V8_OBJECTS_MAP_H_
       7             : 
       8             : #include "src/globals.h"
       9             : #include "src/objects.h"
      10             : #include "src/objects/code.h"
      11             : #include "src/objects/heap-object.h"
      12             : 
      13             : // Has to be the last include (doesn't have include guards):
      14             : #include "src/objects/object-macros.h"
      15             : 
      16             : namespace v8 {
      17             : namespace internal {
      18             : 
      19             : enum InstanceType : uint16_t;
      20             : 
      21             : #define DATA_ONLY_VISITOR_ID_LIST(V) \
      22             :   V(BigInt)                          \
      23             :   V(ByteArray)                       \
      24             :   V(DataObject)                      \
      25             :   V(FixedDoubleArray)                \
      26             :   V(SeqOneByteString)                \
      27             :   V(SeqTwoByteString)
      28             : 
      29             : #define POINTER_VISITOR_ID_LIST(V)     \
      30             :   V(AllocationSite)                    \
      31             :   V(BytecodeArray)                     \
      32             :   V(Cell)                              \
      33             :   V(Code)                              \
      34             :   V(CodeDataContainer)                 \
      35             :   V(ConsString)                        \
      36             :   V(Context)                           \
      37             :   V(DataHandler)                       \
      38             :   V(DescriptorArray)                   \
      39             :   V(EmbedderDataArray)                 \
      40             :   V(EphemeronHashTable)                \
      41             :   V(FeedbackCell)                      \
      42             :   V(FeedbackVector)                    \
      43             :   V(FixedArray)                        \
      44             :   V(FixedFloat64Array)                 \
      45             :   V(FixedTypedArrayBase)               \
      46             :   V(FreeSpace)                         \
      47             :   V(JSApiObject)                       \
      48             :   V(JSArrayBuffer)                     \
      49             :   V(JSDataView)                        \
      50             :   V(JSFunction)                        \
      51             :   V(JSObject)                          \
      52             :   V(JSObjectFast)                      \
      53             :   V(JSTypedArray)                      \
      54             :   V(JSWeakRef)                         \
      55             :   V(JSWeakCollection)                  \
      56             :   V(Map)                               \
      57             :   V(NativeContext)                     \
      58             :   V(Oddball)                           \
      59             :   V(PreparseData)                      \
      60             :   V(PropertyArray)                     \
      61             :   V(PropertyCell)                      \
      62             :   V(PrototypeInfo)                     \
      63             :   V(SharedFunctionInfo)                \
      64             :   V(ShortcutCandidate)                 \
      65             :   V(SlicedString)                      \
      66             :   V(SmallOrderedHashMap)               \
      67             :   V(SmallOrderedHashSet)               \
      68             :   V(SmallOrderedNameDictionary)        \
      69             :   V(Struct)                            \
      70             :   V(Symbol)                            \
      71             :   V(ThinString)                        \
      72             :   V(TransitionArray)                   \
      73             :   V(UncompiledDataWithoutPreparseData) \
      74             :   V(UncompiledDataWithPreparseData)    \
      75             :   V(WasmInstanceObject)                \
      76             :   V(WeakArray)                         \
      77             :   V(WeakCell)
      78             : 
      79             : // Objects with the same visitor id are processed in the same way by
      80             : // the heap visitors. The visitor ids for data only objects must precede
      81             : // other visitor ids. We rely on kDataOnlyVisitorIdCount for quick check
      82             : // of whether an object contains only data or may contain pointers.
      83             : enum VisitorId {
      84             : #define VISITOR_ID_ENUM_DECL(id) kVisit##id,
      85             :   DATA_ONLY_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL) kDataOnlyVisitorIdCount,
      86             :   POINTER_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL)
      87             : #undef VISITOR_ID_ENUM_DECL
      88             :       kVisitorIdCount
      89             : };
      90             : 
      91             : enum class ObjectFields {
      92             :   kDataOnly,
      93             :   kMaybePointers,
      94             : };
      95             : 
      96             : typedef std::vector<Handle<Map>> MapHandles;
      97             : 
      98             : // All heap objects have a Map that describes their structure.
      99             : //  A Map contains information about:
     100             : //  - Size information about the object
     101             : //  - How to iterate over an object (for garbage collection)
     102             : //
     103             : // Map layout:
     104             : // +---------------+---------------------------------------------+
     105             : // |   _ Type _    | _ Description _                             |
     106             : // +---------------+---------------------------------------------+
     107             : // | TaggedPointer | map - Always a pointer to the MetaMap root  |
     108             : // +---------------+---------------------------------------------+
     109             : // | Int           | The first int field                         |
     110             : //  `---+----------+---------------------------------------------+
     111             : //      | Byte     | [instance_size]                             |
     112             : //      +----------+---------------------------------------------+
     113             : //      | Byte     | If Map for a primitive type:                |
     114             : //      |          |   native context index for constructor fn   |
     115             : //      |          | If Map for an Object type:                  |
     116             : //      |          |   inobject properties start offset in words |
     117             : //      +----------+---------------------------------------------+
     118             : //      | Byte     | [used_or_unused_instance_size_in_words]     |
     119             : //      |          | For JSObject in fast mode this byte encodes |
     120             : //      |          | the size of the object that includes only   |
     121             : //      |          | the used property fields or the slack size  |
     122             : //      |          | in properties backing store.                |
     123             : //      +----------+---------------------------------------------+
     124             : //      | Byte     | [visitor_id]                                |
     125             : // +----+----------+---------------------------------------------+
     126             : // | Int           | The second int field                        |
     127             : //  `---+----------+---------------------------------------------+
     128             : //      | Short    | [instance_type]                             |
     129             : //      +----------+---------------------------------------------+
     130             : //      | Byte     | [bit_field]                                 |
     131             : //      |          |   - has_non_instance_prototype (bit 0)      |
     132             : //      |          |   - is_callable (bit 1)                     |
     133             : //      |          |   - has_named_interceptor (bit 2)           |
     134             : //      |          |   - has_indexed_interceptor (bit 3)         |
     135             : //      |          |   - is_undetectable (bit 4)                 |
     136             : //      |          |   - is_access_check_needed (bit 5)          |
     137             : //      |          |   - is_constructor (bit 6)                  |
     138             : //      |          |   - has_prototype_slot (bit 7)              |
     139             : //      +----------+---------------------------------------------+
     140             : //      | Byte     | [bit_field2]                                |
     141             : //      |          |   - is_extensible (bit 0)                   |
     142             : //      |          |   - is_prototype_map (bit 1)                |
     143             : //      |          |   - is_in_retained_map_list (bit 2)         |
     144             : //      |          |   - elements_kind (bits 3..7)               |
     145             : // +----+----------+---------------------------------------------+
     146             : // | Int           | [bit_field3]                                |
     147             : // |               |   - enum_length (bit 0..9)                  |
     148             : // |               |   - number_of_own_descriptors (bit 10..19)  |
     149             : // |               |   - is_dictionary_map (bit 20)              |
     150             : // |               |   - owns_descriptors (bit 21)               |
     151             : // |               |   - has_hidden_prototype (bit 22)           |
     152             : // |               |   - is_deprecated (bit 23)                  |
     153             : // |               |   - is_unstable (bit 24)                    |
     154             : // |               |   - is_migration_target (bit 25)            |
     155             : // |               |   - is_immutable_proto (bit 26)             |
     156             : // |               |   - new_target_is_base (bit 27)             |
     157             : // |               |   - may_have_interesting_symbols (bit 28)   |
     158             : // |               |   - construction_counter (bit 29..31)       |
     159             : // |               |                                             |
     160             : // +*************************************************************+
     161             : // | Int           | On systems with 64bit pointer types, there  |
     162             : // |               | is an unused 32bits after bit_field3        |
     163             : // +*************************************************************+
     164             : // | TaggedPointer | [prototype]                                 |
     165             : // +---------------+---------------------------------------------+
     166             : // | TaggedPointer | [constructor_or_backpointer]                |
     167             : // +---------------+---------------------------------------------+
     168             : // | TaggedPointer | If Map is a prototype map:                  |
     169             : // |               |   [prototype_info]                          |
     170             : // |               | Else:                                       |
     171             : // |               |   [raw_transitions]                         |
     172             : // +---------------+---------------------------------------------+
     173             : // | TaggedPointer | [instance_descriptors]                      |
     174             : // +*************************************************************+
     175             : // ! TaggedPointer ! [layout_descriptors]                        !
     176             : // !               ! Field is only present if compile-time flag  !
     177             : // !               ! FLAG_unbox_double_fields is enabled         !
     178             : // !               ! (basically on 64 bit architectures)         !
     179             : // +*************************************************************+
     180             : // | TaggedPointer | [dependent_code]                            |
     181             : // +---------------+---------------------------------------------+
     182             : 
     183             : class Map : public HeapObject {
     184             :  public:
     185             :   // Instance size.
     186             :   // Size in bytes or kVariableSizeSentinel if instances do not have
     187             :   // a fixed size.
     188             :   DECL_INT_ACCESSORS(instance_size)
     189             :   // Size in words or kVariableSizeSentinel if instances do not have
     190             :   // a fixed size.
     191             :   DECL_INT_ACCESSORS(instance_size_in_words)
     192             : 
     193             :   // [inobject_properties_start_or_constructor_function_index]:
     194             :   // Provides access to the inobject properties start offset in words in case of
     195             :   // JSObject maps, or the constructor function index in case of primitive maps.
     196             :   DECL_INT_ACCESSORS(inobject_properties_start_or_constructor_function_index)
     197             : 
     198             :   // Get/set the in-object property area start offset in words in the object.
     199             :   inline int GetInObjectPropertiesStartInWords() const;
     200             :   inline void SetInObjectPropertiesStartInWords(int value);
     201             :   // Count of properties allocated in the object (JSObject only).
     202             :   inline int GetInObjectProperties() const;
     203             :   // Index of the constructor function in the native context (primitives only),
     204             :   // or the special sentinel value to indicate that there is no object wrapper
     205             :   // for the primitive (i.e. in case of null or undefined).
     206             :   static const int kNoConstructorFunctionIndex = 0;
     207             :   inline int GetConstructorFunctionIndex() const;
     208             :   inline void SetConstructorFunctionIndex(int value);
     209             :   static MaybeHandle<JSFunction> GetConstructorFunction(
     210             :       Handle<Map> map, Handle<Context> native_context);
     211             : 
     212             :   // Retrieve interceptors.
     213             :   inline InterceptorInfo GetNamedInterceptor();
     214             :   inline InterceptorInfo GetIndexedInterceptor();
     215             : 
     216             :   // Instance type.
     217             :   DECL_PRIMITIVE_ACCESSORS(instance_type, InstanceType)
     218             : 
     219             :   // Returns the size of the used in-object area including object header
     220             :   // (only used for JSObject in fast mode, for the other kinds of objects it
     221             :   // is equal to the instance size).
     222             :   inline int UsedInstanceSize() const;
     223             : 
     224             :   // Tells how many unused property fields (in-object or out-of object) are
     225             :   // available in the instance (only used for JSObject in fast mode).
     226             :   inline int UnusedPropertyFields() const;
     227             :   // Tells how many unused in-object property words are present.
     228             :   inline int UnusedInObjectProperties() const;
     229             :   // Updates the counters tracking unused fields in the object.
     230             :   inline void SetInObjectUnusedPropertyFields(int unused_property_fields);
     231             :   // Updates the counters tracking unused fields in the property array.
     232             :   inline void SetOutOfObjectUnusedPropertyFields(int unused_property_fields);
     233             :   inline void CopyUnusedPropertyFields(Map map);
     234             :   inline void CopyUnusedPropertyFieldsAdjustedForInstanceSize(Map map);
     235             :   inline void AccountAddedPropertyField();
     236             :   inline void AccountAddedOutOfObjectPropertyField(
     237             :       int unused_in_property_array);
     238             : 
     239             :   //
     240             :   // Bit field.
     241             :   //
     242             :   DECL_PRIMITIVE_ACCESSORS(bit_field, byte)
     243             :   // Atomic accessors, used for whitelisting legitimate concurrent accesses.
     244             :   DECL_PRIMITIVE_ACCESSORS(relaxed_bit_field, byte)
     245             : 
     246             : // Bit positions for |bit_field|.
     247             : #define MAP_BIT_FIELD_FIELDS(V, _)          \
     248             :   V(HasNonInstancePrototypeBit, bool, 1, _) \
     249             :   V(IsCallableBit, bool, 1, _)              \
     250             :   V(HasNamedInterceptorBit, bool, 1, _)     \
     251             :   V(HasIndexedInterceptorBit, bool, 1, _)   \
     252             :   V(IsUndetectableBit, bool, 1, _)          \
     253             :   V(IsAccessCheckNeededBit, bool, 1, _)     \
     254             :   V(IsConstructorBit, bool, 1, _)           \
     255             :   V(HasPrototypeSlotBit, bool, 1, _)
     256             : 
     257             :   DEFINE_BIT_FIELDS(MAP_BIT_FIELD_FIELDS)
     258             : #undef MAP_BIT_FIELD_FIELDS
     259             : 
     260             :   //
     261             :   // Bit field 2.
     262             :   //
     263             :   DECL_PRIMITIVE_ACCESSORS(bit_field2, byte)
     264             : 
     265             : // Bit positions for |bit_field2|.
     266             : #define MAP_BIT_FIELD2_FIELDS(V, _)     \
     267             :   V(IsExtensibleBit, bool, 1, _)        \
     268             :   V(IsPrototypeMapBit, bool, 1, _)      \
     269             :   V(IsInRetainedMapListBit, bool, 1, _) \
     270             :   V(ElementsKindBits, ElementsKind, 5, _)
     271             : 
     272             :   DEFINE_BIT_FIELDS(MAP_BIT_FIELD2_FIELDS)
     273             : #undef MAP_BIT_FIELD2_FIELDS
     274             : 
     275             :   //
     276             :   // Bit field 3.
     277             :   //
     278             :   DECL_PRIMITIVE_ACCESSORS(bit_field3, uint32_t)
     279             : 
     280             :   // Clear uninitialized padding space. This ensures that the snapshot content
     281             :   // is deterministic. Depending on the V8 build mode there could be no padding.
     282             :   V8_INLINE void clear_padding();
     283             : 
     284             : // Bit positions for |bit_field3|.
     285             : #define MAP_BIT_FIELD3_FIELDS(V, _)                               \
     286             :   V(EnumLengthBits, int, kDescriptorIndexBitCount, _)             \
     287             :   V(NumberOfOwnDescriptorsBits, int, kDescriptorIndexBitCount, _) \
     288             :   V(IsDictionaryMapBit, bool, 1, _)                               \
     289             :   V(OwnsDescriptorsBit, bool, 1, _)                               \
     290             :   V(HasHiddenPrototypeBit, bool, 1, _)                            \
     291             :   V(IsDeprecatedBit, bool, 1, _)                                  \
     292             :   V(IsUnstableBit, bool, 1, _)                                    \
     293             :   V(IsMigrationTargetBit, bool, 1, _)                             \
     294             :   V(IsImmutablePrototypeBit, bool, 1, _)                          \
     295             :   V(NewTargetIsBaseBit, bool, 1, _)                               \
     296             :   V(MayHaveInterestingSymbolsBit, bool, 1, _)                     \
     297             :   V(ConstructionCounterBits, int, 3, _)
     298             : 
     299             :   DEFINE_BIT_FIELDS(MAP_BIT_FIELD3_FIELDS)
     300             : #undef MAP_BIT_FIELD3_FIELDS
     301             : 
     302             :   STATIC_ASSERT(NumberOfOwnDescriptorsBits::kMax >= kMaxNumberOfDescriptors);
     303             : 
     304             :   static const int kSlackTrackingCounterStart = 7;
     305             :   static const int kSlackTrackingCounterEnd = 1;
     306             :   static const int kNoSlackTracking = 0;
     307             :   STATIC_ASSERT(kSlackTrackingCounterStart <= ConstructionCounterBits::kMax);
     308             : 
     309             :   // Inobject slack tracking is the way to reclaim unused inobject space.
     310             :   //
     311             :   // The instance size is initially determined by adding some slack to
     312             :   // expected_nof_properties (to allow for a few extra properties added
     313             :   // after the constructor). There is no guarantee that the extra space
     314             :   // will not be wasted.
     315             :   //
     316             :   // Here is the algorithm to reclaim the unused inobject space:
     317             :   // - Detect the first constructor call for this JSFunction.
     318             :   //   When it happens enter the "in progress" state: initialize construction
     319             :   //   counter in the initial_map.
     320             :   // - While the tracking is in progress initialize unused properties of a new
     321             :   //   object with one_pointer_filler_map instead of undefined_value (the "used"
     322             :   //   part is initialized with undefined_value as usual). This way they can
     323             :   //   be resized quickly and safely.
     324             :   // - Once enough objects have been created  compute the 'slack'
     325             :   //   (traverse the map transition tree starting from the
     326             :   //   initial_map and find the lowest value of unused_property_fields).
     327             :   // - Traverse the transition tree again and decrease the instance size
     328             :   //   of every map. Existing objects will resize automatically (they are
     329             :   //   filled with one_pointer_filler_map). All further allocations will
     330             :   //   use the adjusted instance size.
     331             :   // - SharedFunctionInfo's expected_nof_properties left unmodified since
     332             :   //   allocations made using different closures could actually create different
     333             :   //   kind of objects (see prototype inheritance pattern).
     334             :   //
     335             :   //  Important: inobject slack tracking is not attempted during the snapshot
     336             :   //  creation.
     337             : 
     338             :   static const int kGenerousAllocationCount =
     339             :       kSlackTrackingCounterStart - kSlackTrackingCounterEnd + 1;
     340             : 
     341             :   // Starts the tracking by initializing object constructions countdown counter.
     342             :   void StartInobjectSlackTracking();
     343             : 
     344             :   // True if the object constructions countdown counter is a range
     345             :   // [kSlackTrackingCounterEnd, kSlackTrackingCounterStart].
     346             :   inline bool IsInobjectSlackTrackingInProgress() const;
     347             : 
     348             :   // Does the tracking step.
     349             :   inline void InobjectSlackTrackingStep(Isolate* isolate);
     350             : 
     351             :   // Computes inobject slack for the transition tree starting at this initial
     352             :   // map.
     353             :   int ComputeMinObjectSlack(Isolate* isolate);
     354             :   inline int InstanceSizeFromSlack(int slack) const;
     355             : 
     356             :   // Completes inobject slack tracking for the transition tree starting at this
     357             :   // initial map.
     358             :   void CompleteInobjectSlackTracking(Isolate* isolate);
     359             : 
     360             :   // Tells whether the object in the prototype property will be used
     361             :   // for instances created from this function.  If the prototype
     362             :   // property is set to a value that is not a JSObject, the prototype
     363             :   // property will not be used to create instances of the function.
     364             :   // See ECMA-262, 13.2.2.
     365             :   DECL_BOOLEAN_ACCESSORS(has_non_instance_prototype)
     366             : 
     367             :   // Tells whether the instance has a [[Construct]] internal method.
     368             :   // This property is implemented according to ES6, section 7.2.4.
     369             :   DECL_BOOLEAN_ACCESSORS(is_constructor)
     370             : 
     371             :   // Tells whether the instance with this map may have properties for
     372             :   // interesting symbols on it.
     373             :   // An "interesting symbol" is one for which Name::IsInterestingSymbol()
     374             :   // returns true, i.e. a well-known symbol like @@toStringTag.
     375             :   DECL_BOOLEAN_ACCESSORS(may_have_interesting_symbols)
     376             : 
     377             :   DECL_BOOLEAN_ACCESSORS(has_prototype_slot)
     378             : 
     379             :   // Tells whether the instance with this map has a hidden prototype.
     380             :   DECL_BOOLEAN_ACCESSORS(has_hidden_prototype)
     381             : 
     382             :   // Records and queries whether the instance has a named interceptor.
     383             :   DECL_BOOLEAN_ACCESSORS(has_named_interceptor)
     384             : 
     385             :   // Records and queries whether the instance has an indexed interceptor.
     386             :   DECL_BOOLEAN_ACCESSORS(has_indexed_interceptor)
     387             : 
     388             :   // Tells whether the instance is undetectable.
     389             :   // An undetectable object is a special class of JSObject: 'typeof' operator
     390             :   // returns undefined, ToBoolean returns false. Otherwise it behaves like
     391             :   // a normal JS object.  It is useful for implementing undetectable
     392             :   // document.all in Firefox & Safari.
     393             :   // See https://bugzilla.mozilla.org/show_bug.cgi?id=248549.
     394             :   DECL_BOOLEAN_ACCESSORS(is_undetectable)
     395             : 
     396             :   // Tells whether the instance has a [[Call]] internal method.
     397             :   // This property is implemented according to ES6, section 7.2.3.
     398             :   DECL_BOOLEAN_ACCESSORS(is_callable)
     399             : 
     400             :   DECL_BOOLEAN_ACCESSORS(new_target_is_base)
     401             :   DECL_BOOLEAN_ACCESSORS(is_extensible)
     402             :   DECL_BOOLEAN_ACCESSORS(is_prototype_map)
     403             :   inline bool is_abandoned_prototype_map() const;
     404             : 
     405             :   // Whether the instance has been added to the retained map list by
     406             :   // Heap::AddRetainedMap.
     407             :   DECL_BOOLEAN_ACCESSORS(is_in_retained_map_list)
     408             : 
     409             :   DECL_PRIMITIVE_ACCESSORS(elements_kind, ElementsKind)
     410             : 
     411             :   // Tells whether the instance has fast elements that are only Smis.
     412             :   inline bool has_fast_smi_elements() const;
     413             : 
     414             :   // Tells whether the instance has fast elements.
     415             :   inline bool has_fast_object_elements() const;
     416             :   inline bool has_fast_smi_or_object_elements() const;
     417             :   inline bool has_fast_double_elements() const;
     418             :   inline bool has_fast_elements() const;
     419             :   inline bool has_sloppy_arguments_elements() const;
     420             :   inline bool has_fast_sloppy_arguments_elements() const;
     421             :   inline bool has_fast_string_wrapper_elements() const;
     422             :   inline bool has_fixed_typed_array_elements() const;
     423             :   inline bool has_dictionary_elements() const;
     424             : 
     425             :   // Returns true if the current map doesn't have DICTIONARY_ELEMENTS but if a
     426             :   // map with DICTIONARY_ELEMENTS was found in the prototype chain.
     427             :   bool DictionaryElementsInPrototypeChainOnly(Isolate* isolate);
     428             : 
     429             :   inline Map ElementsTransitionMap();
     430             : 
     431             :   inline FixedArrayBase GetInitialElements() const;
     432             : 
     433             :   // [raw_transitions]: Provides access to the transitions storage field.
     434             :   // Don't call set_raw_transitions() directly to overwrite transitions, use
     435             :   // the TransitionArray::ReplaceTransitions() wrapper instead!
     436             :   DECL_ACCESSORS(raw_transitions, MaybeObject)
     437             :   // [prototype_info]: Per-prototype metadata. Aliased with transitions
     438             :   // (which prototype maps don't have).
     439             :   DECL_ACCESSORS(prototype_info, Object)
     440             :   // PrototypeInfo is created lazily using this helper (which installs it on
     441             :   // the given prototype's map).
     442             :   static Handle<PrototypeInfo> GetOrCreatePrototypeInfo(
     443             :       Handle<JSObject> prototype, Isolate* isolate);
     444             :   static Handle<PrototypeInfo> GetOrCreatePrototypeInfo(
     445             :       Handle<Map> prototype_map, Isolate* isolate);
     446             :   inline bool should_be_fast_prototype_map() const;
     447             :   static void SetShouldBeFastPrototypeMap(Handle<Map> map, bool value,
     448             :                                           Isolate* isolate);
     449             : 
     450             :   // [prototype chain validity cell]: Associated with a prototype object,
     451             :   // stored in that object's map, indicates that prototype chains through this
     452             :   // object are currently valid. The cell will be invalidated and replaced when
     453             :   // the prototype chain changes. When there's nothing to guard (for example,
     454             :   // when direct prototype is null or Proxy) this function returns Smi with
     455             :   // |kPrototypeChainValid| sentinel value.
     456             :   static Handle<Object> GetOrCreatePrototypeChainValidityCell(Handle<Map> map,
     457             :                                                               Isolate* isolate);
     458             :   static const int kPrototypeChainValid = 0;
     459             :   static const int kPrototypeChainInvalid = 1;
     460             : 
     461             :   static bool IsPrototypeChainInvalidated(Map map);
     462             : 
     463             :   // Return the map of the root of object's prototype chain.
     464             :   Map GetPrototypeChainRootMap(Isolate* isolate) const;
     465             : 
     466             :   Map FindRootMap(Isolate* isolate) const;
     467             :   Map FindFieldOwner(Isolate* isolate, int descriptor) const;
     468             : 
     469             :   inline int GetInObjectPropertyOffset(int index) const;
     470             : 
     471             :   class FieldCounts {
     472             :    public:
     473             :     FieldCounts(int mutable_count, int const_count)
     474             :         : mutable_count_(mutable_count), const_count_(const_count) {}
     475             : 
     476     2567060 :     int GetTotal() const { return mutable_count() + const_count(); }
     477             : 
     478             :     int mutable_count() const { return mutable_count_; }
     479             :     int const_count() const { return const_count_; }
     480             : 
     481             :    private:
     482             :     int mutable_count_;
     483             :     int const_count_;
     484             :   };
     485             : 
     486             :   FieldCounts GetFieldCounts() const;
     487             :   int NumberOfFields() const;
     488             : 
     489             :   bool HasOutOfObjectProperties() const;
     490             : 
     491             :   // Returns true if transition to the given map requires special
     492             :   // synchronization with the concurrent marker.
     493             :   bool TransitionRequiresSynchronizationWithGC(Map target) const;
     494             :   // Returns true if transition to the given map removes a tagged in-object
     495             :   // field.
     496             :   bool TransitionRemovesTaggedField(Map target) const;
     497             :   // Returns true if transition to the given map replaces a tagged in-object
     498             :   // field with an untagged in-object field.
     499             :   bool TransitionChangesTaggedFieldToUntaggedField(Map target) const;
     500             : 
     501             :   // TODO(ishell): candidate with JSObject::MigrateToMap().
     502             :   bool InstancesNeedRewriting(Map target) const;
     503             :   bool InstancesNeedRewriting(Map target, int target_number_of_fields,
     504             :                               int target_inobject, int target_unused,
     505             :                               int* old_number_of_fields) const;
     506             :   V8_WARN_UNUSED_RESULT static Handle<FieldType> GeneralizeFieldType(
     507             :       Representation rep1, Handle<FieldType> type1, Representation rep2,
     508             :       Handle<FieldType> type2, Isolate* isolate);
     509             :   static void GeneralizeField(Isolate* isolate, Handle<Map> map,
     510             :                               int modify_index, PropertyConstness new_constness,
     511             :                               Representation new_representation,
     512             :                               Handle<FieldType> new_field_type);
     513             :   // Returns true if the |field_type| is the most general one for
     514             :   // given |representation|.
     515             :   static inline bool IsMostGeneralFieldType(Representation representation,
     516             :                                             FieldType field_type);
     517             : 
     518             :   // Generalizes constness, representation and field_type if objects with given
     519             :   // instance type can have fast elements that can be transitioned by stubs or
     520             :   // optimized code to more general elements kind.
     521             :   // This generalization is necessary in order to ensure that elements kind
     522             :   // transitions performed by stubs / optimized code don't silently transition
     523             :   // PropertyConstness::kMutable fields back to VariableMode::kConst state or
     524             :   // fields with HeapObject representation and "Any" type back to "Class" type.
     525             :   static inline void GeneralizeIfCanHaveTransitionableFastElementsKind(
     526             :       Isolate* isolate, InstanceType instance_type,
     527             :       PropertyConstness* constness, Representation* representation,
     528             :       Handle<FieldType>* field_type);
     529             : 
     530             :   static Handle<Map> ReconfigureProperty(Isolate* isolate, Handle<Map> map,
     531             :                                          int modify_index,
     532             :                                          PropertyKind new_kind,
     533             :                                          PropertyAttributes new_attributes,
     534             :                                          Representation new_representation,
     535             :                                          Handle<FieldType> new_field_type);
     536             : 
     537             :   static Handle<Map> ReconfigureElementsKind(Isolate* isolate, Handle<Map> map,
     538             :                                              ElementsKind new_elements_kind);
     539             : 
     540             :   static Handle<Map> PrepareForDataProperty(Isolate* isolate,
     541             :                                             Handle<Map> old_map,
     542             :                                             int descriptor_number,
     543             :                                             PropertyConstness constness,
     544             :                                             Handle<Object> value);
     545             : 
     546             :   static Handle<Map> Normalize(Isolate* isolate, Handle<Map> map,
     547             :                                PropertyNormalizationMode mode,
     548             :                                const char* reason);
     549             : 
     550             :   // Tells whether the map is used for JSObjects in dictionary mode (ie
     551             :   // normalized objects, ie objects for which HasFastProperties returns false).
     552             :   // A map can never be used for both dictionary mode and fast mode JSObjects.
     553             :   // False by default and for HeapObjects that are not JSObjects.
     554             :   DECL_BOOLEAN_ACCESSORS(is_dictionary_map)
     555             : 
     556             :   // Tells whether the instance needs security checks when accessing its
     557             :   // properties.
     558             :   DECL_BOOLEAN_ACCESSORS(is_access_check_needed)
     559             : 
     560             :   // [prototype]: implicit prototype object.
     561             :   DECL_ACCESSORS(prototype, Object)
     562             :   // TODO(jkummerow): make set_prototype private.
     563             :   static void SetPrototype(Isolate* isolate, Handle<Map> map,
     564             :                            Handle<Object> prototype,
     565             :                            bool enable_prototype_setup_mode = true);
     566             : 
     567             :   // [constructor]: points back to the function or FunctionTemplateInfo
     568             :   // responsible for this map.
     569             :   // The field overlaps with the back pointer. All maps in a transition tree
     570             :   // have the same constructor, so maps with back pointers can walk the
     571             :   // back pointer chain until they find the map holding their constructor.
     572             :   // Returns null_value if there's neither a constructor function nor a
     573             :   // FunctionTemplateInfo available.
     574             :   DECL_ACCESSORS(constructor_or_backpointer, Object)
     575             :   inline Object GetConstructor() const;
     576             :   inline FunctionTemplateInfo GetFunctionTemplateInfo() const;
     577             :   inline void SetConstructor(Object constructor,
     578             :                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
     579             :   // [back pointer]: points back to the parent map from which a transition
     580             :   // leads to this map. The field overlaps with the constructor (see above).
     581             :   inline Object GetBackPointer() const;
     582             :   inline void SetBackPointer(Object value,
     583             :                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
     584             : 
     585             :   // [instance descriptors]: describes the object.
     586             :   inline DescriptorArray instance_descriptors() const;
     587             :   inline DescriptorArray synchronized_instance_descriptors() const;
     588             :   void SetInstanceDescriptors(Isolate* isolate, DescriptorArray descriptors,
     589             :                               int number_of_own_descriptors);
     590             : 
     591             :   // [layout descriptor]: describes the object layout.
     592             :   DECL_ACCESSORS(layout_descriptor, LayoutDescriptor)
     593             :   // |layout descriptor| accessor which can be used from GC.
     594             :   inline LayoutDescriptor layout_descriptor_gc_safe() const;
     595             :   inline bool HasFastPointerLayout() const;
     596             : 
     597             :   // |layout descriptor| accessor that is safe to call even when
     598             :   // FLAG_unbox_double_fields is disabled (in this case Map does not contain
     599             :   // |layout_descriptor| field at all).
     600             :   inline LayoutDescriptor GetLayoutDescriptor() const;
     601             : 
     602             :   inline void UpdateDescriptors(Isolate* isolate, DescriptorArray descriptors,
     603             :                                 LayoutDescriptor layout_descriptor,
     604             :                                 int number_of_own_descriptors);
     605             :   inline void InitializeDescriptors(Isolate* isolate,
     606             :                                     DescriptorArray descriptors,
     607             :                                     LayoutDescriptor layout_descriptor);
     608             : 
     609             :   // [dependent code]: list of optimized codes that weakly embed this map.
     610             :   DECL_ACCESSORS(dependent_code, DependentCode)
     611             : 
     612             :   // [prototype_validity_cell]: Cell containing the validity bit for prototype
     613             :   // chains or Smi(0) if uninitialized.
     614             :   // The meaning of this validity cell is different for prototype maps and
     615             :   // non-prototype maps.
     616             :   // For prototype maps the validity bit "guards" modifications of prototype
     617             :   // chains going through this object. When a prototype object changes, both its
     618             :   // own validity cell and those of all "downstream" prototypes are invalidated;
     619             :   // handlers for a given receiver embed the currently valid cell for that
     620             :   // receiver's prototype during their creation and check it on execution.
     621             :   // For non-prototype maps which are used as transitioning store handlers this
     622             :   // field contains the validity cell which guards modifications of this map's
     623             :   // prototype.
     624             :   DECL_ACCESSORS(prototype_validity_cell, Object)
     625             : 
     626             :   // Returns true if prototype validity cell value represents "valid" prototype
     627             :   // chain state.
     628             :   inline bool IsPrototypeValidityCellValid() const;
     629             : 
     630             :   inline PropertyDetails GetLastDescriptorDetails() const;
     631             : 
     632             :   inline int LastAdded() const;
     633             : 
     634             :   inline int NumberOfOwnDescriptors() const;
     635             :   inline void SetNumberOfOwnDescriptors(int number);
     636             : 
     637             :   inline Cell RetrieveDescriptorsPointer();
     638             : 
     639             :   // Checks whether all properties are stored either in the map or on the object
     640             :   // (inobject, properties, or elements backing store), requiring no special
     641             :   // checks.
     642             :   bool OnlyHasSimpleProperties() const;
     643             :   inline int EnumLength() const;
     644             :   inline void SetEnumLength(int length);
     645             : 
     646             :   DECL_BOOLEAN_ACCESSORS(owns_descriptors)
     647             : 
     648             :   inline void mark_unstable();
     649             :   inline bool is_stable() const;
     650             : 
     651             :   DECL_BOOLEAN_ACCESSORS(is_migration_target)
     652             : 
     653             :   DECL_BOOLEAN_ACCESSORS(is_immutable_proto)
     654             : 
     655             :   // This counter is used for in-object slack tracking.
     656             :   // The in-object slack tracking is considered enabled when the counter is
     657             :   // non zero. The counter only has a valid count for initial maps. For
     658             :   // transitioned maps only kNoSlackTracking has a meaning, namely that inobject
     659             :   // slack tracking already finished for the transition tree. Any other value
     660             :   // indicates that either inobject slack tracking is still in progress, or that
     661             :   // the map isn't part of the transition tree anymore.
     662             :   DECL_INT_ACCESSORS(construction_counter)
     663             : 
     664             :   DECL_BOOLEAN_ACCESSORS(is_deprecated)
     665             :   inline bool CanBeDeprecated() const;
     666             :   // Returns a non-deprecated version of the input. If the input was not
     667             :   // deprecated, it is directly returned. Otherwise, the non-deprecated version
     668             :   // is found by re-transitioning from the root of the transition tree using the
     669             :   // descriptor array of the map. Returns MaybeHandle<Map>() if no updated map
     670             :   // is found.
     671             :   static MaybeHandle<Map> TryUpdate(Isolate* isolate,
     672             :                                     Handle<Map> map) V8_WARN_UNUSED_RESULT;
     673             :   static Map TryUpdateSlow(Isolate* isolate, Map map) V8_WARN_UNUSED_RESULT;
     674             : 
     675             :   // Returns a non-deprecated version of the input. This method may deprecate
     676             :   // existing maps along the way if encodings conflict. Not for use while
     677             :   // gathering type feedback. Use TryUpdate in those cases instead.
     678             :   static Handle<Map> Update(Isolate* isolate, Handle<Map> map);
     679             : 
     680             :   static inline Handle<Map> CopyInitialMap(Isolate* isolate, Handle<Map> map);
     681             :   static Handle<Map> CopyInitialMap(Isolate* isolate, Handle<Map> map,
     682             :                                     int instance_size, int in_object_properties,
     683             :                                     int unused_property_fields);
     684             :   static Handle<Map> CopyInitialMapNormalized(
     685             :       Isolate* isolate, Handle<Map> map,
     686             :       PropertyNormalizationMode mode = CLEAR_INOBJECT_PROPERTIES);
     687             :   static Handle<Map> CopyDropDescriptors(Isolate* isolate, Handle<Map> map);
     688             :   static Handle<Map> CopyInsertDescriptor(Isolate* isolate, Handle<Map> map,
     689             :                                           Descriptor* descriptor,
     690             :                                           TransitionFlag flag);
     691             : 
     692             :   static MaybeObjectHandle WrapFieldType(Isolate* isolate,
     693             :                                          Handle<FieldType> type);
     694             :   static FieldType UnwrapFieldType(MaybeObject wrapped_type);
     695             : 
     696             :   V8_WARN_UNUSED_RESULT static MaybeHandle<Map> CopyWithField(
     697             :       Isolate* isolate, Handle<Map> map, Handle<Name> name,
     698             :       Handle<FieldType> type, PropertyAttributes attributes,
     699             :       PropertyConstness constness, Representation representation,
     700             :       TransitionFlag flag);
     701             : 
     702             :   V8_WARN_UNUSED_RESULT static MaybeHandle<Map> CopyWithConstant(
     703             :       Isolate* isolate, Handle<Map> map, Handle<Name> name,
     704             :       Handle<Object> constant, PropertyAttributes attributes,
     705             :       TransitionFlag flag);
     706             : 
     707             :   // Returns a new map with all transitions dropped from the given map and
     708             :   // the ElementsKind set.
     709             :   static Handle<Map> TransitionElementsTo(Isolate* isolate, Handle<Map> map,
     710             :                                           ElementsKind to_kind);
     711             : 
     712             :   static Handle<Map> AsElementsKind(Isolate* isolate, Handle<Map> map,
     713             :                                     ElementsKind kind);
     714             : 
     715             :   static Handle<Map> CopyAsElementsKind(Isolate* isolate, Handle<Map> map,
     716             :                                         ElementsKind kind, TransitionFlag flag);
     717             : 
     718             :   static Handle<Map> AsLanguageMode(Isolate* isolate, Handle<Map> initial_map,
     719             :                                     Handle<SharedFunctionInfo> shared_info);
     720             : 
     721             :   static Handle<Map> CopyForPreventExtensions(Isolate* isolate, Handle<Map> map,
     722             :                                               PropertyAttributes attrs_to_add,
     723             :                                               Handle<Symbol> transition_marker,
     724             :                                               const char* reason);
     725             : 
     726             :   static Handle<Map> FixProxy(Handle<Map> map, InstanceType type, int size);
     727             : 
     728             :   // Maximal number of fast properties. Used to restrict the number of map
     729             :   // transitions to avoid an explosion in the number of maps for objects used as
     730             :   // dictionaries.
     731             :   inline bool TooManyFastProperties(StoreOrigin store_origin) const;
     732             :   static Handle<Map> TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
     733             :                                               Handle<Name> name,
     734             :                                               Handle<Object> value,
     735             :                                               PropertyAttributes attributes,
     736             :                                               PropertyConstness constness,
     737             :                                               StoreOrigin store_origin);
     738             :   static Handle<Map> TransitionToAccessorProperty(
     739             :       Isolate* isolate, Handle<Map> map, Handle<Name> name, int descriptor,
     740             :       Handle<Object> getter, Handle<Object> setter,
     741             :       PropertyAttributes attributes);
     742             :   static Handle<Map> ReconfigureExistingProperty(Isolate* isolate,
     743             :                                                  Handle<Map> map,
     744             :                                                  int descriptor,
     745             :                                                  PropertyKind kind,
     746             :                                                  PropertyAttributes attributes);
     747             : 
     748             :   inline void AppendDescriptor(Isolate* isolate, Descriptor* desc);
     749             : 
     750             :   // Returns a copy of the map, prepared for inserting into the transition
     751             :   // tree (if the |map| owns descriptors then the new one will share
     752             :   // descriptors with |map|).
     753             :   static Handle<Map> CopyForElementsTransition(Isolate* isolate,
     754             :                                                Handle<Map> map);
     755             : 
     756             :   // Returns a copy of the map, with all transitions dropped from the
     757             :   // instance descriptors.
     758             :   static Handle<Map> Copy(Isolate* isolate, Handle<Map> map,
     759             :                           const char* reason);
     760             :   static Handle<Map> Create(Isolate* isolate, int inobject_properties);
     761             : 
     762             :   // Returns the next free property index (only valid for FAST MODE).
     763             :   int NextFreePropertyIndex() const;
     764             : 
     765             :   // Returns the number of enumerable properties.
     766             :   int NumberOfEnumerableProperties() const;
     767             : 
     768             :   DECL_CAST(Map)
     769             : 
     770             :   static inline int SlackForArraySize(int old_size, int size_limit);
     771             : 
     772             :   static void EnsureDescriptorSlack(Isolate* isolate, Handle<Map> map,
     773             :                                     int slack);
     774             : 
     775             :   // Returns the map to be used for instances when the given {prototype} is
     776             :   // passed to an Object.create call. Might transition the given {prototype}.
     777             :   static Handle<Map> GetObjectCreateMap(Isolate* isolate,
     778             :                                         Handle<HeapObject> prototype);
     779             : 
     780             :   // Similar to {GetObjectCreateMap} but does not transition {prototype} and
     781             :   // fails gracefully by returning an empty handle instead.
     782             :   static MaybeHandle<Map> TryGetObjectCreateMap(Isolate* isolate,
     783             :                                                 Handle<HeapObject> prototype);
     784             : 
     785             :   // Computes a hash value for this map, to be used in HashTables and such.
     786             :   int Hash();
     787             : 
     788             :   // Returns the transitioned map for this map with the most generic
     789             :   // elements_kind that's found in |candidates|, or |nullptr| if no match is
     790             :   // found at all.
     791             :   Map FindElementsKindTransitionedMap(Isolate* isolate,
     792             :                                       MapHandles const& candidates);
     793             : 
     794             :   inline bool CanTransition() const;
     795             : 
     796             : #define DECL_TESTER(Type, ...) inline bool Is##Type##Map() const;
     797             :   INSTANCE_TYPE_CHECKERS(DECL_TESTER)
     798             : #undef DECL_TESTER
     799             :   inline bool IsBooleanMap() const;
     800             :   inline bool IsNullOrUndefinedMap() const;
     801             :   inline bool IsPrimitiveMap() const;
     802             :   inline bool IsSpecialReceiverMap() const;
     803             :   inline bool IsCustomElementsReceiverMap() const;
     804             : 
     805             :   bool IsMapInArrayPrototypeChain(Isolate* isolate) const;
     806             : 
     807             :   // Dispatched behavior.
     808             :   void MapPrint(std::ostream& os);
     809             :   DECL_VERIFIER(Map)
     810             : 
     811             : #ifdef VERIFY_HEAP
     812             :   void DictionaryMapVerify(Isolate* isolate);
     813             : #endif
     814             : 
     815             :   DECL_PRIMITIVE_ACCESSORS(visitor_id, VisitorId)
     816             : 
     817             :   static ObjectFields ObjectFieldsFrom(VisitorId visitor_id) {
     818             :     return (visitor_id < kDataOnlyVisitorIdCount)
     819             :                ? ObjectFields::kDataOnly
     820    53115120 :                : ObjectFields::kMaybePointers;
     821             :   }
     822             : 
     823             :   static Handle<Map> TransitionToPrototype(Isolate* isolate, Handle<Map> map,
     824             :                                            Handle<Object> prototype);
     825             : 
     826             :   static Handle<Map> TransitionToImmutableProto(Isolate* isolate,
     827             :                                                 Handle<Map> map);
     828             : 
     829             :   static const int kMaxPreAllocatedPropertyFields = 255;
     830             : 
     831             :   // Layout description.
     832             : #define MAP_FIELDS(V)                                                       \
     833             :   /* Raw data fields. */                                                    \
     834             :   V(kInstanceSizeInWordsOffset, kUInt8Size)                                 \
     835             :   V(kInObjectPropertiesStartOrConstructorFunctionIndexOffset, kUInt8Size)   \
     836             :   V(kUsedOrUnusedInstanceSizeInWordsOffset, kUInt8Size)                     \
     837             :   V(kVisitorIdOffset, kUInt8Size)                                           \
     838             :   V(kInstanceTypeOffset, kUInt16Size)                                       \
     839             :   V(kBitFieldOffset, kUInt8Size)                                            \
     840             :   V(kBitField2Offset, kUInt8Size)                                           \
     841             :   V(kBitField3Offset, kUInt32Size)                                          \
     842             :   /* Adds padding to make tagged fields kTaggedSize-aligned. */             \
     843             :   V(kOptionalPaddingOffset, OBJECT_POINTER_PADDING(kOptionalPaddingOffset)) \
     844             :   /* Pointer fields. */                                                     \
     845             :   V(kPointerFieldsBeginOffset, 0)                                           \
     846             :   V(kPrototypeOffset, kTaggedSize)                                          \
     847             :   V(kConstructorOrBackPointerOffset, kTaggedSize)                           \
     848             :   V(kTransitionsOrPrototypeInfoOffset, kTaggedSize)                         \
     849             :   V(kDescriptorsOffset, kTaggedSize)                                        \
     850             :   V(kLayoutDescriptorOffset, FLAG_unbox_double_fields ? kTaggedSize : 0)    \
     851             :   V(kDependentCodeOffset, kTaggedSize)                                      \
     852             :   V(kPrototypeValidityCellOffset, kTaggedSize)                              \
     853             :   V(kPointerFieldsEndOffset, 0)                                             \
     854             :   /* Total size. */                                                         \
     855             :   V(kSize, 0)
     856             : 
     857             :   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, MAP_FIELDS)
     858             : #undef MAP_FIELDS
     859             : 
     860             :   STATIC_ASSERT(kInstanceTypeOffset == Internals::kMapInstanceTypeOffset);
     861             : 
     862             :   class BodyDescriptor;
     863             : 
     864             :   // Compares this map to another to see if they describe equivalent objects.
     865             :   // If |mode| is set to CLEAR_INOBJECT_PROPERTIES, |other| is treated as if
     866             :   // it had exactly zero inobject properties.
     867             :   // The "shared" flags of both this map and |other| are ignored.
     868             :   bool EquivalentToForNormalization(const Map other,
     869             :                                     PropertyNormalizationMode mode) const;
     870             : 
     871             :   // Returns true if given field is unboxed double.
     872             :   inline bool IsUnboxedDoubleField(FieldIndex index) const;
     873             : 
     874             :   void PrintMapDetails(std::ostream& os);
     875             : 
     876             :   static inline Handle<Map> AddMissingTransitionsForTesting(
     877             :       Isolate* isolate, Handle<Map> split_map,
     878             :       Handle<DescriptorArray> descriptors,
     879             :       Handle<LayoutDescriptor> full_layout_descriptor);
     880             : 
     881             :   // Fires when the layout of an object with a leaf map changes.
     882             :   // This includes adding transitions to the leaf map or changing
     883             :   // the descriptor array.
     884             :   inline void NotifyLeafMapLayoutChange(Isolate* isolate);
     885             : 
     886             :   static VisitorId GetVisitorId(Map map);
     887             : 
     888             :   // Returns true if objects with given instance type are allowed to have
     889             :   // fast transitionable elements kinds. This predicate is used to ensure
     890             :   // that objects that can have transitionable fast elements kind will not
     891             :   // get in-place generalizable fields because the elements kind transition
     892             :   // performed by stubs or optimized code can't properly generalize such
     893             :   // fields.
     894             :   static inline bool CanHaveFastTransitionableElementsKind(
     895             :       InstanceType instance_type);
     896             :   inline bool CanHaveFastTransitionableElementsKind() const;
     897             : 
     898             :  private:
     899             :   // This byte encodes either the instance size without the in-object slack or
     900             :   // the slack size in properties backing store.
     901             :   // Let H be JSObject::kHeaderSize / kTaggedSize.
     902             :   // If value >= H then:
     903             :   //     - all field properties are stored in the object.
     904             :   //     - there is no property array.
     905             :   //     - value * kTaggedSize is the actual object size without the slack.
     906             :   // Otherwise:
     907             :   //     - there is no slack in the object.
     908             :   //     - the property array has value slack slots.
     909             :   // Note that this encoding requires that H = JSObject::kFieldsAdded.
     910             :   DECL_INT_ACCESSORS(used_or_unused_instance_size_in_words)
     911             : 
     912             :   // Returns the map that this (root) map transitions to if its elements_kind
     913             :   // is changed to |elements_kind|, or |nullptr| if no such map is cached yet.
     914             :   Map LookupElementsTransitionMap(Isolate* isolate, ElementsKind elements_kind);
     915             : 
     916             :   // Tries to replay property transitions starting from this (root) map using
     917             :   // the descriptor array of the |map|. The |root_map| is expected to have
     918             :   // proper elements kind and therefore elements kinds transitions are not
     919             :   // taken by this function. Returns |nullptr| if matching transition map is
     920             :   // not found.
     921             :   Map TryReplayPropertyTransitions(Isolate* isolate, Map map);
     922             : 
     923             :   static void ConnectTransition(Isolate* isolate, Handle<Map> parent,
     924             :                                 Handle<Map> child, Handle<Name> name,
     925             :                                 SimpleTransitionFlag flag);
     926             : 
     927             :   bool EquivalentToForTransition(const Map other) const;
     928             :   bool EquivalentToForElementsKindTransition(const Map other) const;
     929             :   static Handle<Map> RawCopy(Isolate* isolate, Handle<Map> map,
     930             :                              int instance_size, int inobject_properties);
     931             :   static Handle<Map> ShareDescriptor(Isolate* isolate, Handle<Map> map,
     932             :                                      Handle<DescriptorArray> descriptors,
     933             :                                      Descriptor* descriptor);
     934             :   static Handle<Map> AddMissingTransitions(
     935             :       Isolate* isolate, Handle<Map> map, Handle<DescriptorArray> descriptors,
     936             :       Handle<LayoutDescriptor> full_layout_descriptor);
     937             :   static void InstallDescriptors(
     938             :       Isolate* isolate, Handle<Map> parent_map, Handle<Map> child_map,
     939             :       int new_descriptor, Handle<DescriptorArray> descriptors,
     940             :       Handle<LayoutDescriptor> full_layout_descriptor);
     941             :   static Handle<Map> CopyAddDescriptor(Isolate* isolate, Handle<Map> map,
     942             :                                        Descriptor* descriptor,
     943             :                                        TransitionFlag flag);
     944             :   static Handle<Map> CopyReplaceDescriptors(
     945             :       Isolate* isolate, Handle<Map> map, Handle<DescriptorArray> descriptors,
     946             :       Handle<LayoutDescriptor> layout_descriptor, TransitionFlag flag,
     947             :       MaybeHandle<Name> maybe_name, const char* reason,
     948             :       SimpleTransitionFlag simple_flag);
     949             : 
     950             :   static Handle<Map> CopyReplaceDescriptor(Isolate* isolate, Handle<Map> map,
     951             :                                            Handle<DescriptorArray> descriptors,
     952             :                                            Descriptor* descriptor, int index,
     953             :                                            TransitionFlag flag);
     954             :   static Handle<Map> CopyNormalized(Isolate* isolate, Handle<Map> map,
     955             :                                     PropertyNormalizationMode mode);
     956             : 
     957             :   // TODO(ishell): Move to MapUpdater.
     958             :   static Handle<Map> CopyGeneralizeAllFields(Isolate* isolate, Handle<Map> map,
     959             :                                              ElementsKind elements_kind,
     960             :                                              int modify_index,
     961             :                                              PropertyKind kind,
     962             :                                              PropertyAttributes attributes,
     963             :                                              const char* reason);
     964             : 
     965             :   void DeprecateTransitionTree(Isolate* isolate);
     966             : 
     967             :   void ReplaceDescriptors(Isolate* isolate, DescriptorArray new_descriptors,
     968             :                           LayoutDescriptor new_layout_descriptor);
     969             : 
     970             :   // Update field type of the given descriptor to new representation and new
     971             :   // type. The type must be prepared for storing in descriptor array:
     972             :   // it must be either a simple type or a map wrapped in a weak cell.
     973             :   void UpdateFieldType(Isolate* isolate, int descriptor_number,
     974             :                        Handle<Name> name, PropertyConstness new_constness,
     975             :                        Representation new_representation,
     976             :                        const MaybeObjectHandle& new_wrapped_type);
     977             : 
     978             :   // TODO(ishell): Move to MapUpdater.
     979             :   void PrintReconfiguration(Isolate* isolate, FILE* file, int modify_index,
     980             :                             PropertyKind kind, PropertyAttributes attributes);
     981             :   // TODO(ishell): Move to MapUpdater.
     982             :   void PrintGeneralization(
     983             :       Isolate* isolate, FILE* file, const char* reason, int modify_index,
     984             :       int split, int descriptors, bool constant_to_field,
     985             :       Representation old_representation, Representation new_representation,
     986             :       MaybeHandle<FieldType> old_field_type, MaybeHandle<Object> old_value,
     987             :       MaybeHandle<FieldType> new_field_type, MaybeHandle<Object> new_value);
     988             : 
     989             :   // Use the high-level instance_descriptors/SetInstanceDescriptors instead.
     990             :   inline void set_synchronized_instance_descriptors(
     991             :       DescriptorArray array, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
     992             : 
     993             :   static const int kFastPropertiesSoftLimit = 12;
     994             :   static const int kMaxFastProperties = 128;
     995             : 
     996             :   friend class MapUpdater;
     997             : 
     998      661024 :   OBJECT_CONSTRUCTORS(Map, HeapObject);
     999             : };
    1000             : 
    1001             : // The cache for maps used by normalized (dictionary mode) objects.
    1002             : // Such maps do not have property descriptors, so a typical program
    1003             : // needs very limited number of distinct normalized maps.
    1004             : class NormalizedMapCache : public WeakFixedArray {
    1005             :  public:
    1006             :   NEVER_READ_ONLY_SPACE
    1007             :   static Handle<NormalizedMapCache> New(Isolate* isolate);
    1008             : 
    1009             :   V8_WARN_UNUSED_RESULT MaybeHandle<Map> Get(Handle<Map> fast_map,
    1010             :                                              PropertyNormalizationMode mode);
    1011             :   void Set(Handle<Map> fast_map, Handle<Map> normalized_map);
    1012             : 
    1013             :   DECL_CAST(NormalizedMapCache)
    1014             :   DECL_VERIFIER(NormalizedMapCache)
    1015             : 
    1016             :  private:
    1017             :   friend bool HeapObject::IsNormalizedMapCache() const;
    1018             : 
    1019             :   static const int kEntries = 64;
    1020             : 
    1021             :   static inline int GetIndex(Handle<Map> map);
    1022             : 
    1023             :   // The following declarations hide base class methods.
    1024             :   Object get(int index);
    1025             :   void set(int index, Object value);
    1026             : 
    1027             :   OBJECT_CONSTRUCTORS(NormalizedMapCache, WeakFixedArray);
    1028             : };
    1029             : 
    1030             : }  // namespace internal
    1031             : }  // namespace v8
    1032             : 
    1033             : #include "src/objects/object-macros-undef.h"
    1034             : 
    1035             : #endif  // V8_OBJECTS_MAP_H_

Generated by: LCOV version 1.10