1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299
|
/*
* Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
* Copyright (C) 2003-2023 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
*/
#pragma once
#include "ArgList.h"
#include "ArrayConventions.h"
#include "Butterfly.h"
#include "JSCell.h"
#include "JSObject.h"
namespace JSC {
class JSArray;
class LLIntOffsetsExtractor;
extern const ASCIILiteral LengthExceededTheMaximumArrayLengthError;
class JSArray : public JSNonFinalObject {
friend class LLIntOffsetsExtractor;
friend class Walker;
friend class JIT;
WTF_ALLOW_COMPACT_POINTERS;
public:
typedef JSNonFinalObject Base;
static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetOwnSpecialPropertyNames | OverridesPut;
static size_t allocationSize(Checked<size_t> inlineCapacity)
{
ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
return sizeof(JSArray);
}
template<typename CellType, SubspaceAccess>
static GCClient::IsoSubspace* subspaceFor(VM& vm)
{
return &vm.arraySpace();
}
protected:
explicit JSArray(VM& vm, Structure* structure, Butterfly* butterfly)
: JSNonFinalObject(vm, structure, butterfly)
{
}
public:
static JSArray* tryCreate(VM&, Structure*, unsigned initialLength = 0);
static JSArray* tryCreate(VM&, Structure*, unsigned initialLength, unsigned vectorLengthHint);
static JSArray* create(VM&, Structure*, unsigned initialLength = 0);
static JSArray* createWithButterfly(VM&, GCDeferralContext*, Structure*, Butterfly*);
// tryCreateUninitializedRestricted is used for fast construction of arrays whose size and
// contents are known at time of creation. This is a restricted API for careful use only in
// performance critical code paths. If you don't have a good reason to use it, you probably
// shouldn't use it. Instead, you should go with
// - JSArray::tryCreate() or JSArray::create() instead of tryCreateUninitializedRestricted(), and
// - putDirectIndex() instead of initializeIndex().
//
// Clients of this interface must:
// - null-check the result (indicating out of memory, or otherwise unable to allocate vector).
// - call 'initializeIndex' for all properties in sequence, for 0 <= i < initialLength.
// - Provide a valid GCDefferalContext* if they might garbage collect when initializing properties,
// otherwise the caller can provide a null GCDefferalContext*.
// - Provide a local stack instance of ObjectInitializationScope at the call site.
//
JS_EXPORT_PRIVATE static JSArray* tryCreateUninitializedRestricted(ObjectInitializationScope&, GCDeferralContext*, Structure*, unsigned initialLength);
static JSArray* tryCreateUninitializedRestricted(ObjectInitializationScope& scope, Structure* structure, unsigned initialLength)
{
return tryCreateUninitializedRestricted(scope, nullptr, structure, initialLength);
}
static void eagerlyInitializeButterfly(ObjectInitializationScope&, JSArray*, unsigned initialLength);
JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, JSGlobalObject*, PropertyName, const PropertyDescriptor&, bool throwException);
JS_EXPORT_PRIVATE static bool getOwnPropertySlot(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);
DECLARE_EXPORT_INFO;
// OK if we know this is a JSArray, but not if it could be an object of a derived class; for RuntimeArray this always returns 0.
unsigned length() const { return getArrayLength(); }
// OK to use on new arrays, but not if it might be a RegExpMatchArray or RuntimeArray.
JS_EXPORT_PRIVATE bool setLength(JSGlobalObject*, unsigned, bool throwException = false);
void pushInline(JSGlobalObject*, JSValue);
JS_EXPORT_PRIVATE void push(JSGlobalObject*, JSValue);
JS_EXPORT_PRIVATE JSValue pop(JSGlobalObject*);
static JSArray* fastSlice(JSGlobalObject*, JSObject* source, uint64_t startIndex, uint64_t count);
bool holesMustForwardToPrototype() const;
bool canFastCopy(JSArray* otherArray) const;
bool canFastAppend(JSArray* otherArray) const;
bool canDoFastIndexedAccess() const;
// This function returns NonArray if the indexing types are not compatable for copying.
IndexingType mergeIndexingTypeForCopying(IndexingType other, bool allowPromotion);
bool appendMemcpy(JSGlobalObject*, VM&, unsigned startIndex, JSArray* otherArray);
bool appendMemcpy(JSGlobalObject*, VM&, unsigned startIndex, IndexingType, std::span<const EncodedJSValue>);
ALWAYS_INLINE bool definitelyNegativeOneMiss() const;
enum ShiftCountMode {
// This form of shift hints that we're doing queueing. With this assumption in hand,
// we convert to ArrayStorage, which has queue optimizations.
ShiftCountForShift,
// This form of shift hints that we're just doing care and feeding on an array that
// is probably typically used for ordinary accesses. With this assumption in hand,
// we try to preserve whatever indexing type it has already.
ShiftCountForSplice
};
template<ShiftCountMode shiftCountMode>
bool shiftCount(JSGlobalObject* globalObject, unsigned& startIndex, unsigned count)
{
constexpr unsigned shiftThreashold = 128;
UNUSED_VARIABLE(shiftThreashold);
if constexpr (shiftCountMode == ShiftCountForShift)
return shiftCountWithAnyIndexingType(globalObject, startIndex, count, shiftThreashold);
else if constexpr (shiftCountMode == ShiftCountForSplice)
return shiftCountWithAnyIndexingType(globalObject, startIndex, count, UINT32_MAX);
RELEASE_ASSERT_NOT_REACHED();
return false;
}
bool unshiftCount(JSGlobalObject* globalObject, unsigned startIndex, unsigned count)
{
return unshiftCountWithAnyIndexingType(globalObject, startIndex, count);
}
JS_EXPORT_PRIVATE void fillArgList(JSGlobalObject*, MarkedArgumentBuffer&);
JS_EXPORT_PRIVATE void copyToArguments(JSGlobalObject*, JSValue* firstElementDest, unsigned offset, unsigned length);
JS_EXPORT_PRIVATE bool isIteratorProtocolFastAndNonObservable();
inline static Structure* createStructure(VM&, JSGlobalObject*, JSValue, IndexingType);
protected:
#if ASSERT_ENABLED
void finishCreation(VM& vm)
{
Base::finishCreation(vm);
ASSERT(jsDynamicCast<JSArray*>(this));
ASSERT_WITH_MESSAGE(type() == ArrayType || type() == DerivedArrayType, "Instance inheriting JSArray should have either ArrayType or DerivedArrayType");
}
#endif
static bool put(JSCell*, JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);
static bool deleteProperty(JSCell*, JSGlobalObject*, PropertyName, DeletePropertySlot&);
JS_EXPORT_PRIVATE static void getOwnSpecialPropertyNames(JSObject*, JSGlobalObject*, PropertyNameArray&, DontEnumPropertiesMode);
private:
bool isLengthWritable()
{
ArrayStorage* storage = arrayStorageOrNull();
if (!storage)
return true;
SparseArrayValueMap* map = storage->m_sparseMap.get();
return !map || !map->lengthIsReadOnly();
}
bool shiftCountWithAnyIndexingType(JSGlobalObject*, unsigned& startIndex, unsigned count, unsigned shiftArrayStorageThreshold);
JS_EXPORT_PRIVATE bool shiftCountWithArrayStorage(VM&, unsigned startIndex, unsigned count, ArrayStorage*);
bool unshiftCountWithAnyIndexingType(JSGlobalObject*, unsigned startIndex, unsigned count);
bool unshiftCountWithArrayStorage(JSGlobalObject*, unsigned startIndex, unsigned count, ArrayStorage*);
bool unshiftCountSlowCase(const AbstractLocker&, VM&, DeferGC&, bool, unsigned);
bool setLengthWithArrayStorage(JSGlobalObject*, unsigned newLength, bool throwException, ArrayStorage*);
void setLengthWritable(JSGlobalObject*, bool writable);
};
inline Butterfly* tryCreateArrayButterfly(VM& vm, JSObject* intendedOwner, unsigned initialLength)
{
Butterfly* butterfly = Butterfly::tryCreate(
vm, intendedOwner, 0, 0, true, baseIndexingHeaderForArrayStorage(initialLength),
ArrayStorage::sizeFor(BASE_ARRAY_STORAGE_VECTOR_LEN));
if (!butterfly)
return nullptr;
ArrayStorage* storage = butterfly->arrayStorage();
storage->m_sparseMap.clear();
storage->m_indexBias = 0;
storage->m_numValuesInVector = 0;
return butterfly;
}
inline JSArray* JSArray::tryCreate(VM& vm, Structure* structure, unsigned initialLength, unsigned vectorLengthHint)
{
ASSERT(vectorLengthHint >= initialLength);
unsigned outOfLineStorage = structure->outOfLineCapacity();
Butterfly* butterfly;
IndexingType indexingType = structure->indexingType();
if (LIKELY(!hasAnyArrayStorage(indexingType))) {
ASSERT(
hasUndecided(indexingType)
|| hasInt32(indexingType)
|| hasDouble(indexingType)
|| hasContiguous(indexingType));
if (UNLIKELY(vectorLengthHint > MAX_STORAGE_VECTOR_LENGTH))
return nullptr;
unsigned vectorLength = Butterfly::optimalContiguousVectorLength(structure, vectorLengthHint);
void* temp = vm.auxiliarySpace().allocate(
vm,
Butterfly::totalSize(0, outOfLineStorage, true, vectorLength * sizeof(EncodedJSValue)),
nullptr, AllocationFailureMode::ReturnNull);
if (!temp)
return nullptr;
butterfly = Butterfly::fromBase(temp, 0, outOfLineStorage);
butterfly->setVectorLength(vectorLength);
butterfly->setPublicLength(initialLength);
if (hasDouble(indexingType))
clearArray(butterfly->contiguousDouble().data(), vectorLength);
else
clearArray(butterfly->contiguous().data(), vectorLength);
} else {
ASSERT(
indexingType == ArrayWithSlowPutArrayStorage
|| indexingType == ArrayWithArrayStorage);
butterfly = tryCreateArrayButterfly(vm, nullptr, initialLength);
if (!butterfly)
return nullptr;
for (unsigned i = 0; i < BASE_ARRAY_STORAGE_VECTOR_LEN; ++i)
butterfly->arrayStorage()->m_vector[i].clear();
}
return createWithButterfly(vm, nullptr, structure, butterfly);
}
inline JSArray* JSArray::tryCreate(VM& vm, Structure* structure, unsigned initialLength)
{
return tryCreate(vm, structure, initialLength, initialLength);
}
inline JSArray* JSArray::create(VM& vm, Structure* structure, unsigned initialLength)
{
JSArray* result = JSArray::tryCreate(vm, structure, initialLength);
RELEASE_ASSERT(result);
return result;
}
inline JSArray* JSArray::createWithButterfly(VM& vm, GCDeferralContext* deferralContext, Structure* structure, Butterfly* butterfly)
{
JSArray* array = new (NotNull, allocateCell<JSArray>(vm, deferralContext)) JSArray(vm, structure, butterfly);
array->finishCreation(vm);
return array;
}
JSArray* asArray(JSValue);
inline JSArray* asArray(JSCell* cell)
{
ASSERT(cell->inherits<JSArray>());
return jsCast<JSArray*>(cell);
}
inline JSArray* asArray(JSValue value)
{
return asArray(value.asCell());
}
inline bool isJSArray(JSCell* cell)
{
ASSERT((cell->classInfo() == JSArray::info()) == (cell->type() == ArrayType));
return cell->type() == ArrayType;
}
inline bool isJSArray(JSValue v) { return v.isCell() && isJSArray(v.asCell()); }
JS_EXPORT_PRIVATE JSArray* constructArray(JSGlobalObject*, Structure*, const ArgList& values);
JS_EXPORT_PRIVATE JSArray* constructArray(JSGlobalObject*, Structure*, const JSValue* values, unsigned length);
JS_EXPORT_PRIVATE JSArray* constructArrayNegativeIndexed(JSGlobalObject*, Structure*, const JSValue* values, unsigned length);
ALWAYS_INLINE uint64_t toLength(JSGlobalObject*, JSObject*);
} // namespace JSC
|