// Copyright 2019 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "src/objects/js-objects.h" #include <limits> #include <optional> #include "src/api/api-arguments-inl.h" #include "src/api/api-natives.h" #include "src/common/assert-scope.h" #include "src/common/globals.h" #include "src/date/date.h" #include "src/execution/arguments.h" #include "src/execution/frames.h" #include "src/execution/isolate-utils.h" #include "src/execution/isolate.h" #include "src/handles/handles-inl.h" #include "src/handles/maybe-handles.h" #include "src/heap/factory-inl.h" #include "src/heap/heap-inl.h" #include "src/heap/mutable-page-metadata.h" #include "src/heap/pretenuring-handler-inl.h" #include "src/init/bootstrapper.h" #include "src/logging/counters.h" #include "src/logging/log.h" #include "src/objects/allocation-site-inl.h" #include "src/objects/api-callbacks.h" #include "src/objects/arguments-inl.h" #include "src/objects/dictionary.h" #include "src/objects/elements.h" #include "src/objects/field-type.h" #include "src/objects/fixed-array.h" #include "src/objects/heap-number.h" #include "src/objects/heap-object.h" #include "src/objects/js-array-buffer-inl.h" #include "src/objects/js-array-inl.h" #include "src/objects/js-atomics-synchronization.h" #include "src/objects/js-collection.h" #include "src/objects/js-disposable-stack.h" #include "src/objects/js-generator-inl.h" #include "src/objects/js-iterator-helpers-inl.h" #include "src/objects/js-promise.h" #include "src/objects/js-raw-json-inl.h" #include "src/objects/js-regexp-inl.h" #include "src/objects/js-regexp-string-iterator.h" #include "src/objects/js-shadow-realm.h" #include "src/objects/js-shared-array-inl.h" #include "src/objects/js-struct-inl.h" #include "src/objects/js-temporal-objects-inl.h" #include "src/objects/js-weak-refs.h" #include "src/objects/lookup.h" #include "src/objects/map-inl.h" #include "src/objects/map-updater.h" #include "src/objects/module.h" #include "src/objects/objects-body-descriptors-inl.h" #include "src/objects/objects-inl.h" #include "src/objects/oddball.h" #include "src/objects/property-cell.h" #include "src/objects/property-descriptor.h" #include "src/objects/property.h" #include "src/objects/prototype-info.h" #include "src/objects/prototype.h" #include "src/objects/shared-function-info.h" #include "src/objects/swiss-name-dictionary-inl.h" #include "src/objects/tagged.h" #include "src/objects/transitions.h" #include "src/strings/string-builder-inl.h" #include "src/strings/string-stream.h" #include "src/utils/ostreams.h" #if V8_ENABLE_WEBASSEMBLY #include "src/debug/debug-wasm-objects.h" #include "src/wasm/wasm-objects.h" #endif // V8_ENABLE_WEBASSEMBLY #ifdef V8_INTL_SUPPORT #include "src/objects/js-break-iterator.h" #include "src/objects/js-collator.h" #include "src/objects/js-date-time-format.h" #include "src/objects/js-display-names.h" #include "src/objects/js-duration-format.h" #include "src/objects/js-list-format.h" #include "src/objects/js-locale.h" #include "src/objects/js-number-format.h" #include "src/objects/js-plural-rules.h" #include "src/objects/js-relative-time-format.h" #include "src/objects/js-segment-iterator.h" #include "src/objects/js-segmenter.h" #include "src/objects/js-segments.h" #endif // V8_INTL_SUPPORT namespace v8::internal { // static Maybe<bool> JSReceiver::HasProperty(LookupIterator* it) { … } // static Maybe<bool> JSReceiver::HasOwnProperty(Isolate* isolate, Handle<JSReceiver> object, Handle<Name> name) { … } Handle<Object> JSReceiver::GetDataProperty(LookupIterator* it, AllocationPolicy allocation_policy) { … } // static Maybe<bool> JSReceiver::HasInPrototypeChain(Isolate* isolate, Handle<JSReceiver> object, Handle<Object> proto) { … } // static Maybe<bool> JSReceiver::CheckPrivateNameStore(LookupIterator* it, bool is_define) { … } namespace { bool HasExcludedProperty( const base::ScopedVector<Handle<Object>>* excluded_properties, DirectHandle<Object> search_element) { … } V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign( Isolate* isolate, Handle<JSReceiver> target, Handle<Object> source, PropertiesEnumerationMode mode, const base::ScopedVector<Handle<Object>>* excluded_properties, bool use_set) { … } } // namespace // static Maybe<bool> JSReceiver::SetOrCopyDataProperties( Isolate* isolate, Handle<JSReceiver> target, Handle<Object> source, PropertiesEnumerationMode mode, const base::ScopedVector<Handle<Object>>* excluded_properties, bool use_set) { … } Tagged<String> JSReceiver::class_name() { … } namespace { std::pair<MaybeHandle<JSFunction>, Handle<String>> GetConstructorHelper( Isolate* isolate, Handle<JSReceiver> receiver) { … } } // anonymous namespace // static MaybeHandle<JSFunction> JSReceiver::GetConstructor( Isolate* isolate, Handle<JSReceiver> receiver) { … } // static Handle<String> JSReceiver::GetConstructorName(Isolate* isolate, Handle<JSReceiver> receiver) { … } // static MaybeHandle<NativeContext> JSReceiver::GetFunctionRealm( DirectHandle<JSReceiver> receiver) { … } // static MaybeHandle<NativeContext> JSReceiver::GetContextForMicrotask( DirectHandle<JSReceiver> receiver) { … } Maybe<PropertyAttributes> JSReceiver::GetPropertyAttributes( LookupIterator* it) { … } namespace { Tagged<Object> SetHashAndUpdateProperties(Tagged<HeapObject> properties, int hash) { … } int GetIdentityHashHelper(Tagged<JSReceiver> object) { … } } // namespace void JSReceiver::SetIdentityHash(int hash) { … } void JSReceiver::SetProperties(Tagged<HeapObject> properties) { … } Tagged<Object> JSReceiver::GetIdentityHash() { … } // static Tagged<Smi> JSReceiver::CreateIdentityHash(Isolate* isolate, Tagged<JSReceiver> key) { … } Tagged<Smi> JSReceiver::GetOrCreateIdentityHash(Isolate* isolate) { … } void JSReceiver::DeleteNormalizedProperty(DirectHandle<JSReceiver> object, InternalIndex entry) { … } Maybe<bool> JSReceiver::DeleteProperty(LookupIterator* it, LanguageMode language_mode) { … } Maybe<bool> JSReceiver::DeleteElement(Handle<JSReceiver> object, uint32_t index, LanguageMode language_mode) { … } Maybe<bool> JSReceiver::DeleteProperty(Handle<JSReceiver> object, Handle<Name> name, LanguageMode language_mode) { … } Maybe<bool> JSReceiver::DeletePropertyOrElement(Handle<JSReceiver> object, Handle<Name> name, LanguageMode language_mode) { … } // ES6 19.1.2.4 // static Tagged<Object> JSReceiver::DefineProperty(Isolate* isolate, Handle<Object> object, Handle<Object> key, Handle<Object> attributes) { … } // ES6 19.1.2.3.1 // static MaybeHandle<Object> JSReceiver::DefineProperties(Isolate* isolate, Handle<Object> object, Handle<Object> properties) { … } // static Maybe<bool> JSReceiver::DefineOwnProperty(Isolate* isolate, Handle<JSReceiver> object, Handle<Object> key, PropertyDescriptor* desc, Maybe<ShouldThrow> should_throw) { … } // static Maybe<bool> JSReceiver::OrdinaryDefineOwnProperty( Isolate* isolate, Handle<JSObject> object, Handle<Object> key, PropertyDescriptor* desc, Maybe<ShouldThrow> should_throw) { … } namespace { MaybeHandle<JSAny> GetPropertyWithInterceptorInternal( LookupIterator* it, Handle<InterceptorInfo> interceptor, bool* done) { … } Maybe<PropertyAttributes> GetPropertyAttributesWithInterceptorInternal( LookupIterator* it, Handle<InterceptorInfo> interceptor) { … } Maybe<InterceptorResult> SetPropertyWithInterceptorInternal( LookupIterator* it, DirectHandle<InterceptorInfo> interceptor, Maybe<ShouldThrow> should_throw, Handle<Object> value) { … } Maybe<InterceptorResult> DefinePropertyWithInterceptorInternal( LookupIterator* it, DirectHandle<InterceptorInfo> interceptor, Maybe<ShouldThrow> should_throw, PropertyDescriptor* desc) { … } } // namespace // ES6 9.1.6.1 // static Maybe<bool> JSReceiver::OrdinaryDefineOwnProperty( Isolate* isolate, Handle<JSObject> object, const PropertyKey& key, PropertyDescriptor* desc, Maybe<ShouldThrow> should_throw) { … } // ES6 9.1.6.2 // static Maybe<bool> JSReceiver::IsCompatiblePropertyDescriptor( Isolate* isolate, bool extensible, PropertyDescriptor* desc, PropertyDescriptor* current, Handle<Name> property_name, Maybe<ShouldThrow> should_throw) { … } // https://tc39.es/ecma262/#sec-validateandapplypropertydescriptor // static Maybe<bool> JSReceiver::ValidateAndApplyPropertyDescriptor( Isolate* isolate, LookupIterator* it, bool extensible, PropertyDescriptor* desc, PropertyDescriptor* current, Maybe<ShouldThrow> should_throw, Handle<Name> property_name) { … } // static Maybe<bool> JSReceiver::CreateDataProperty(Isolate* isolate, Handle<JSReceiver> object, Handle<Name> key, Handle<Object> value, Maybe<ShouldThrow> should_throw) { … } // static Maybe<bool> JSReceiver::CreateDataProperty(Isolate* isolate, Handle<Object> object, PropertyKey key, Handle<Object> value, Maybe<ShouldThrow> should_throw) { … } // static Maybe<bool> JSReceiver::CreateDataProperty(Isolate* isolate, Handle<JSReceiver> object, PropertyKey key, Handle<Object> value, Maybe<ShouldThrow> should_throw) { … } // static Maybe<bool> JSReceiver::AddPrivateField(LookupIterator* it, Handle<Object> value, Maybe<ShouldThrow> should_throw) { … } // static Maybe<bool> JSReceiver::GetOwnPropertyDescriptor(Isolate* isolate, Handle<JSReceiver> object, Handle<Object> key, PropertyDescriptor* desc) { … } namespace { Maybe<bool> GetPropertyDescriptorWithInterceptor(LookupIterator* it, PropertyDescriptor* desc) { … } } // namespace // ES6 9.1.5.1 // Returns true on success, false if the property didn't exist, nothing if // an exception was thrown. // static Maybe<bool> JSReceiver::GetOwnPropertyDescriptor(LookupIterator* it, PropertyDescriptor* desc) { … } Maybe<bool> JSReceiver::SetIntegrityLevel(Isolate* isolate, Handle<JSReceiver> receiver, IntegrityLevel level, ShouldThrow should_throw) { … } namespace { Maybe<bool> GenericTestIntegrityLevel(Isolate* isolate, Handle<JSReceiver> receiver, PropertyAttributes level) { … } } // namespace Maybe<bool> JSReceiver::TestIntegrityLevel(Isolate* isolate, Handle<JSReceiver> receiver, IntegrityLevel level) { … } Maybe<bool> JSReceiver::PreventExtensions(Isolate* isolate, Handle<JSReceiver> object, ShouldThrow should_throw) { … } Maybe<bool> JSReceiver::IsExtensible(Isolate* isolate, Handle<JSReceiver> object) { … } // static MaybeHandle<Object> JSReceiver::ToPrimitive(Isolate* isolate, Handle<JSReceiver> receiver, ToPrimitiveHint hint) { … } // static MaybeHandle<Object> JSReceiver::OrdinaryToPrimitive( Isolate* isolate, Handle<JSReceiver> receiver, OrdinaryToPrimitiveHint hint) { … } V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries( Isolate* isolate, DirectHandle<JSReceiver> receiver, bool get_entries, Handle<FixedArray>* result) { … } MaybeHandle<FixedArray> GetOwnValuesOrEntries(Isolate* isolate, Handle<JSReceiver> object, PropertyFilter filter, bool try_fast_path, bool get_entries) { … } MaybeHandle<FixedArray> JSReceiver::GetOwnValues(Isolate* isolate, Handle<JSReceiver> object, PropertyFilter filter, bool try_fast_path) { … } MaybeHandle<FixedArray> JSReceiver::GetOwnEntries(Isolate* isolate, Handle<JSReceiver> object, PropertyFilter filter, bool try_fast_path) { … } Maybe<bool> JSReceiver::SetPrototype(Isolate* isolate, Handle<JSReceiver> object, Handle<Object> value, bool from_javascript, ShouldThrow should_throw) { … } bool JSReceiver::HasProxyInPrototype(Isolate* isolate) { … } bool JSReceiver::IsCodeLike(Isolate* isolate) const { … } // static MaybeHandle<JSObject> JSObject::New(Handle<JSFunction> constructor, Handle<JSReceiver> new_target, DirectHandle<AllocationSite> site, NewJSObjectType new_js_object_type) { … } // static MaybeHandle<JSObject> JSObject::NewWithMap(Isolate* isolate, DirectHandle<Map> initial_map, DirectHandle<AllocationSite> site, NewJSObjectType new_js_object_type) { … } // 9.1.12 ObjectCreate ( proto [ , internalSlotsList ] ) // Notice: This is NOT 19.1.2.2 Object.create ( O, Properties ) MaybeHandle<JSObject> JSObject::ObjectCreate(Isolate* isolate, Handle<Object> prototype) { … } void JSObject::EnsureWritableFastElements(DirectHandle<JSObject> object) { … } // For FATAL in JSObject::GetHeaderSize static const char* NonAPIInstanceTypeToString(InstanceType instance_type) { … } int JSObject::GetHeaderSize(InstanceType type, bool function_has_prototype_slot) { … } MaybeHandle<JSAny> JSObject::GetPropertyWithFailedAccessCheck( LookupIterator* it) { … } Maybe<PropertyAttributes> JSObject::GetPropertyAttributesWithFailedAccessCheck( LookupIterator* it) { … } Maybe<bool> JSObject::SetPropertyWithFailedAccessCheck( LookupIterator* it, Handle<Object> value, Maybe<ShouldThrow> should_throw) { … } void JSObject::SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name, Handle<Object> value, PropertyDetails details) { … } void JSObject::SetNormalizedElement(Handle<JSObject> object, uint32_t index, Handle<Object> value, PropertyDetails details) { … } void JSObject::JSObjectShortPrint(StringStream* accumulator) { … } void JSObject::PrintElementsTransition( FILE* file, DirectHandle<JSObject> object, ElementsKind from_kind, DirectHandle<FixedArrayBase> from_elements, ElementsKind to_kind, DirectHandle<FixedArrayBase> to_elements) { … } void JSObject::PrintInstanceMigration(FILE* file, Tagged<Map> original_map, Tagged<Map> new_map) { … } // static bool JSObject::IsUnmodifiedApiObject(FullObjectSlot o) { … } // static void JSObject::UpdatePrototypeUserRegistration(DirectHandle<Map> old_map, DirectHandle<Map> new_map, Isolate* isolate) { … } // static void JSObject::NotifyMapChange(DirectHandle<Map> old_map, DirectHandle<Map> new_map, Isolate* isolate) { … } namespace { // To migrate a fast instance to a fast map: // - First check whether the instance needs to be rewritten. If not, simply // change the map. // - Otherwise, allocate a fixed array large enough to hold all fields, in // addition to unused space. // - Copy all existing properties in, in the following order: backing store // properties, unused fields, inobject properties. // - If all allocation succeeded, commit the state atomically: // * Copy inobject properties from the backing store back into the object. // * Trim the difference in instance size of the object. This also cleanly // frees inobject properties that moved to the backing store. // * If there are properties left in the backing store, trim of the space used // to temporarily store the inobject properties. // * If there are properties left in the backing store, install the backing // store. void MigrateFastToFast(Isolate* isolate, DirectHandle<JSObject> object, DirectHandle<Map> new_map) { … } void MigrateFastToSlow(Isolate* isolate, DirectHandle<JSObject> object, DirectHandle<Map> new_map, int expected_additional_properties) { … } } // namespace void JSObject::MigrateToMap(Isolate* isolate, DirectHandle<JSObject> object, DirectHandle<Map> new_map, int expected_additional_properties) { … } void JSObject::ForceSetPrototype(Isolate* isolate, DirectHandle<JSObject> object, Handle<HeapObject> proto) { … } Maybe<InterceptorResult> JSObject::SetPropertyWithInterceptor( LookupIterator* it, Maybe<ShouldThrow> should_throw, Handle<Object> value) { … } Handle<Map> JSObject::GetElementsTransitionMap(DirectHandle<JSObject> object, ElementsKind to_kind) { … } void JSObject::AllocateStorageForMap(Handle<JSObject> object, Handle<Map> map) { … } void JSObject::MigrateInstance(Isolate* isolate, DirectHandle<JSObject> object) { … } // static bool JSObject::TryMigrateInstance(Isolate* isolate, DirectHandle<JSObject> object) { … } namespace { bool TryFastAddDataProperty(Isolate* isolate, DirectHandle<JSObject> object, DirectHandle<Name> name, DirectHandle<Object> value, PropertyAttributes attributes) { … } } // namespace void JSObject::AddProperty(Isolate* isolate, Handle<JSObject> object, Handle<Name> name, DirectHandle<Object> value, PropertyAttributes attributes) { … } void JSObject::AddProperty(Isolate* isolate, Handle<JSObject> object, const char* name, DirectHandle<Object> value, PropertyAttributes attributes) { … } // Reconfigures a property to a data property with attributes, even if it is not // reconfigurable. // Requires a LookupIterator that does not look at the prototype chain beyond // hidden prototypes. MaybeHandle<Object> JSObject::DefineOwnPropertyIgnoreAttributes( LookupIterator* it, Handle<Object> value, PropertyAttributes attributes, AccessorInfoHandling handling, EnforceDefineSemantics semantics) { … } Maybe<bool> JSObject::DefineOwnPropertyIgnoreAttributes( LookupIterator* it, Handle<Object> value, PropertyAttributes attributes, Maybe<ShouldThrow> should_throw, AccessorInfoHandling handling, EnforceDefineSemantics semantics, StoreOrigin store_origin) { … } MaybeHandle<Object> JSObject::SetOwnPropertyIgnoreAttributes( Handle<JSObject> object, Handle<Name> name, Handle<Object> value, PropertyAttributes attributes) { … } MaybeHandle<Object> JSObject::SetOwnElementIgnoreAttributes( Handle<JSObject> object, size_t index, Handle<Object> value, PropertyAttributes attributes) { … } MaybeHandle<Object> JSObject::DefinePropertyOrElementIgnoreAttributes( Handle<JSObject> object, Handle<Name> name, Handle<Object> value, PropertyAttributes attributes) { … } Maybe<PropertyAttributes> JSObject::GetPropertyAttributesWithInterceptor( LookupIterator* it) { … } void JSObject::NormalizeProperties(Isolate* isolate, DirectHandle<JSObject> object, PropertyNormalizationMode mode, int expected_additional_properties, bool use_cache, const char* reason) { … } void JSObject::MigrateSlowToFast(DirectHandle<JSObject> object, int unused_property_fields, const char* reason) { … } void JSObject::RequireSlowElements(Tagged<NumberDictionary> dictionary) { … } Handle<NumberDictionary> JSObject::NormalizeElements(Handle<JSObject> object) { … } Maybe<InterceptorResult> JSObject::DeletePropertyWithInterceptor( LookupIterator* it, ShouldThrow should_throw) { … } Maybe<bool> JSObject::CreateDataProperty(Isolate* isolate, Handle<JSObject> object, PropertyKey key, Handle<Object> value, Maybe<ShouldThrow> should_throw) { … } namespace { template <typename Dictionary> bool TestDictionaryPropertiesIntegrityLevel(Tagged<Dictionary> dict, ReadOnlyRoots roots, PropertyAttributes level) { … } bool TestFastPropertiesIntegrityLevel(Tagged<Map> map, PropertyAttributes level) { … } bool TestPropertiesIntegrityLevel(Tagged<JSObject> object, PropertyAttributes level) { … } bool TestElementsIntegrityLevel(Tagged<JSObject> object, PropertyAttributes level) { … } bool FastTestIntegrityLevel(Tagged<JSObject> object, PropertyAttributes level) { … } } // namespace Maybe<bool> JSObject::TestIntegrityLevel(Isolate* isolate, Handle<JSObject> object, IntegrityLevel level) { … } Maybe<bool> JSObject::PreventExtensions(Isolate* isolate, Handle<JSObject> object, ShouldThrow should_throw) { … } bool JSObject::IsExtensible(Isolate* isolate, Handle<JSObject> object) { … } // static MaybeHandle<Object> JSObject::ReadFromOptionsBag(Handle<Object> options, Handle<String> option_name, Isolate* isolate) { … } template <typename Dictionary> void JSObject::ApplyAttributesToDictionary( Isolate* isolate, ReadOnlyRoots roots, Handle<Dictionary> dictionary, const PropertyAttributes attributes) { … } template void JSObject::ApplyAttributesToDictionary( Isolate* isolate, ReadOnlyRoots roots, Handle<NumberDictionary> dictionary, const PropertyAttributes attributes); Handle<NumberDictionary> CreateElementDictionary(Isolate* isolate, Handle<JSObject> object) { … } template <PropertyAttributes attrs> Maybe<bool> JSObject::PreventExtensionsWithTransition( Isolate* isolate, Handle<JSObject> object, ShouldThrow should_throw) { … } Handle<JSAny> JSObject::FastPropertyAt(Isolate* isolate, DirectHandle<JSObject> object, Representation representation, FieldIndex index) { … } Handle<JSAny> JSObject::FastPropertyAt(Isolate* isolate, DirectHandle<JSObject> object, Representation representation, FieldIndex index, SeqCstAccessTag tag) { … } // static Handle<Object> JSObject::DictionaryPropertyAt(Isolate* isolate, DirectHandle<JSObject> object, InternalIndex dict_index) { … } // static std::optional<Tagged<Object>> JSObject::DictionaryPropertyAt( DirectHandle<JSObject> object, InternalIndex dict_index, Heap* heap) { … } // TODO(cbruni/jkummerow): Consider moving this into elements.cc. bool JSObject::HasEnumerableElements() { … } MaybeHandle<Object> JSObject::DefineOwnAccessorIgnoreAttributes( Handle<JSObject> object, Handle<Name> name, DirectHandle<Object> getter, DirectHandle<Object> setter, PropertyAttributes attributes) { … } MaybeHandle<Object> JSObject::DefineOwnAccessorIgnoreAttributes( LookupIterator* it, DirectHandle<Object> getter, DirectHandle<Object> setter, PropertyAttributes attributes) { … } MaybeHandle<Object> JSObject::SetAccessor(Handle<JSObject> object, Handle<Name> name, Handle<AccessorInfo> info, PropertyAttributes attributes) { … } // static Maybe<bool> JSObject::CheckIfCanDefineAsConfigurable( Isolate* isolate, LookupIterator* it, DirectHandle<Object> value, Maybe<ShouldThrow> should_throw) { … } Tagged<Object> JSObject::SlowReverseLookup(Tagged<Object> value) { … } void JSObject::PrototypeRegistryCompactionCallback(Tagged<HeapObject> value, int old_index, int new_index) { … } // static void JSObject::MakePrototypesFast(Handle<Object> receiver, WhereToStart where_to_start, Isolate* isolate) { … } static bool PrototypeBenefitsFromNormalization(Tagged<JSObject> object) { … } // static void JSObject::OptimizeAsPrototype(DirectHandle<JSObject> object, bool enable_setup_mode) { … } // static void JSObject::ReoptimizeIfPrototype(DirectHandle<JSObject> object) { … } // static void JSObject::LazyRegisterPrototypeUser(DirectHandle<Map> user, Isolate* isolate) { … } // Can be called regardless of whether |user| was actually registered with // |prototype|. Returns true when there was a registration. // static bool JSObject::UnregisterPrototypeUser(DirectHandle<Map> user, Isolate* isolate) { … } namespace { // This function must be kept in sync with // AccessorAssembler::InvalidateValidityCellIfPrototype() which does pre-checks // before jumping here. void InvalidateOnePrototypeValidityCellInternal(Tagged<Map> map) { … } void InvalidatePrototypeChainsInternal(Tagged<Map> map) { … } } // namespace // static Tagged<Map> JSObject::InvalidatePrototypeChains(Tagged<Map> map) { … } // We also invalidate global objects validity cell when a new lexical // environment variable is added. This is necessary to ensure that // Load/StoreGlobalIC handlers that load/store from global object's prototype // get properly invalidated. // Note, that the normal Load/StoreICs that load/store through the global object // in the prototype chain are not affected by appearance of a new lexical // variable and therefore we don't propagate invalidation down. // static void JSObject::InvalidatePrototypeValidityCell(Tagged<JSGlobalObject> global) { … } Maybe<bool> JSObject::SetPrototype(Isolate* isolate, Handle<JSObject> object, Handle<Object> value, bool from_javascript, ShouldThrow should_throw) { … } // static void JSObject::SetImmutableProto(DirectHandle<JSObject> object) { … } void JSObject::EnsureCanContainElements(Handle<JSObject> object, JavaScriptArguments* args, uint32_t arg_count, EnsureElementsMode mode) { … } void JSObject::ValidateElements(Tagged<JSObject> object) { … } bool JSObject::WouldConvertToSlowElements(uint32_t index) { … } static bool ShouldConvertToFastElements(Tagged<JSObject> object, Tagged<NumberDictionary> dictionary, uint32_t index, uint32_t* new_capacity) { … } static ElementsKind BestFittingFastElementsKind(Tagged<JSObject> object) { … } // static Maybe<bool> JSObject::AddDataElement(Handle<JSObject> object, uint32_t index, DirectHandle<Object> value, PropertyAttributes attributes) { … } template <AllocationSiteUpdateMode update_or_check> bool JSObject::UpdateAllocationSite(DirectHandle<JSObject> object, ElementsKind to_kind) { … } template bool JSObject::UpdateAllocationSite<AllocationSiteUpdateMode::kCheckOnly>( DirectHandle<JSObject> object, ElementsKind to_kind); template bool JSObject::UpdateAllocationSite<AllocationSiteUpdateMode::kUpdate>( DirectHandle<JSObject> object, ElementsKind to_kind); void JSObject::TransitionElementsKind(Handle<JSObject> object, ElementsKind to_kind) { … } template <typename BackingStore> static int HoleyElementsUsage(Tagged<JSObject> object, Tagged<BackingStore> store) { … } int JSObject::GetFastElementsUsage() { … } MaybeHandle<JSAny> JSObject::GetPropertyWithInterceptor(LookupIterator* it, bool* done) { … } Maybe<bool> JSObject::HasRealNamedProperty(Isolate* isolate, Handle<JSObject> object, Handle<Name> name) { … } Maybe<bool> JSObject::HasRealElementProperty(Isolate* isolate, Handle<JSObject> object, uint32_t index) { … } Maybe<bool> JSObject::HasRealNamedCallbackProperty(Isolate* isolate, Handle<JSObject> object, Handle<Name> name) { … } Tagged<Object> JSObject::RawFastPropertyAtCompareAndSwap( FieldIndex index, Tagged<Object> expected, Tagged<Object> value, SeqCstAccessTag tag) { … } bool JSGlobalProxy::IsDetached() { … } void JSGlobalObject::InvalidatePropertyCell(DirectHandle<JSGlobalObject> global, Handle<Name> name) { … } // static MaybeHandle<JSDate> JSDate::New(Handle<JSFunction> constructor, Handle<JSReceiver> new_target, double tv) { … } // static int64_t JSDate::CurrentTimeValue(Isolate* isolate) { … } // static Address JSDate::GetField(Isolate* isolate, Address raw_object, Address smi_index) { … } Tagged<Object> JSDate::DoGetField(Isolate* isolate, FieldIndex index) { … } Tagged<Object> JSDate::GetUTCField(FieldIndex index, double value, DateCache* date_cache) { … } // static void JSDate::SetValue(double value) { … } void JSDate::SetNanValue() { … } void JSDate::SetCachedFields(int64_t local_time_ms, DateCache* date_cache) { … } // static void JSMessageObject::InitializeSourcePositions( Isolate* isolate, DirectHandle<JSMessageObject> message) { … } int JSMessageObject::GetLineNumber() const { … } int JSMessageObject::GetColumnNumber() const { … } Tagged<String> JSMessageObject::GetSource() const { … } Handle<String> JSMessageObject::GetSourceLine() const { … } } // namespace v8::internal
Codebase Browser
chromium