1 // Copyright 2019 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #ifndef V8_COMPILER_HEAP_REFS_H_
6 #define V8_COMPILER_HEAP_REFS_H_
7 
8 #include "src/base/optional.h"
9 #include "src/ic/call-optimization.h"
10 #include "src/objects/elements-kind.h"
11 #include "src/objects/feedback-vector.h"
12 #include "src/objects/instance-type.h"
13 
14 namespace v8 {
15 class CFunctionInfo;
16 
17 namespace internal {
18 
19 class BytecodeArray;
20 class CallHandlerInfo;
21 class FixedDoubleArray;
22 class FunctionTemplateInfo;
23 class HeapNumber;
24 class InternalizedString;
25 class JSBoundFunction;
26 class JSDataView;
27 class JSGlobalProxy;
28 class JSRegExp;
29 class JSTypedArray;
30 class NativeContext;
31 class ScriptContextTable;
32 
33 namespace compiler {
34 // Whether we are loading a property or storing to a property.
35 // For a store during literal creation, do not walk up the prototype chain.
36 enum class AccessMode { kLoad, kStore, kStoreInLiteral, kHas };
37 
38 enum class SerializationPolicy { kAssumeSerialized, kSerializeIfNeeded };
39 
40 enum class OddballType : uint8_t {
41   kNone,     // Not an Oddball.
42   kBoolean,  // True or False.
43   kUndefined,
44   kNull,
45   kHole,
46   kUninitialized,
47   kOther  // Oddball, but none of the above.
48 };
49 
50 // This list is sorted such that subtypes appear before their supertypes.
51 // DO NOT VIOLATE THIS PROPERTY!
52 #define HEAP_BROKER_OBJECT_LIST(V) \
53   /* Subtypes of JSObject */       \
54   V(JSArray)                       \
55   V(JSBoundFunction)               \
56   V(JSDataView)                    \
57   V(JSFunction)                    \
58   V(JSGlobalObject)                \
59   V(JSGlobalProxy)                 \
60   V(JSRegExp)                      \
61   V(JSTypedArray)                  \
62   /* Subtypes of Context */        \
63   V(NativeContext)                 \
64   /* Subtypes of FixedArray */     \
65   V(Context)                       \
66   V(ScopeInfo)                     \
67   V(ScriptContextTable)            \
68   /* Subtypes of FixedArrayBase */ \
69   V(BytecodeArray)                 \
70   V(FixedArray)                    \
71   V(FixedDoubleArray)              \
72   /* Subtypes of Name */           \
73   V(InternalizedString)            \
74   V(String)                        \
75   V(Symbol)                        \
76   /* Subtypes of JSReceiver */     \
77   V(JSObject)                      \
78   /* Subtypes of HeapObject */     \
79   V(AccessorInfo)                  \
80   V(AllocationSite)                \
81   V(ArrayBoilerplateDescription)   \
82   V(BigInt)                        \
83   V(CallHandlerInfo)               \
84   V(Cell)                          \
85   V(Code)                          \
86   V(DescriptorArray)               \
87   V(FeedbackCell)                  \
88   V(FeedbackVector)                \
89   V(FixedArrayBase)                \
90   V(FunctionTemplateInfo)          \
91   V(HeapNumber)                    \
92   V(JSReceiver)                    \
93   V(Map)                           \
94   V(Name)                          \
95   V(ObjectBoilerplateDescription)  \
96   V(PropertyCell)                  \
97   V(SharedFunctionInfo)            \
98   V(SourceTextModule)              \
99   V(TemplateObjectDescription)     \
100   /* Subtypes of Object */         \
101   V(HeapObject)
102 
103 class CompilationDependencies;
104 struct FeedbackSource;
105 class JSHeapBroker;
106 class ObjectData;
107 class PerIsolateCompilerCache;
108 class PropertyAccessInfo;
109 #define FORWARD_DECL(Name) class Name##Ref;
HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)110 HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
111 #undef FORWARD_DECL
112 
113 class V8_EXPORT_PRIVATE ObjectRef {
114  public:
115   ObjectRef(JSHeapBroker* broker, Handle<Object> object,
116             bool check_type = true);
117   ObjectRef(JSHeapBroker* broker, ObjectData* data, bool check_type = true)
118       : data_(data), broker_(broker) {
119     CHECK_NOT_NULL(data_);
120   }
121 
122   Handle<Object> object() const;
123 
124   bool equals(const ObjectRef& other) const;
125 
126   bool IsSmi() const;
127   int AsSmi() const;
128 
129 #define HEAP_IS_METHOD_DECL(Name) bool Is##Name() const;
130   HEAP_BROKER_OBJECT_LIST(HEAP_IS_METHOD_DECL)
131 #undef HEAP_IS_METHOD_DECL
132 
133 #define HEAP_AS_METHOD_DECL(Name) Name##Ref As##Name() const;
134   HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
135 #undef HEAP_AS_METHOD_DECL
136 
137   bool IsNullOrUndefined() const;
138 
139   bool BooleanValue() const;
140   Maybe<double> OddballToNumber() const;
141 
142   // Return the element at key {index} if {index} is known to be an own data
143   // property of the object that is non-writable and non-configurable.
144   base::Optional<ObjectRef> GetOwnConstantElement(
145       uint32_t index, SerializationPolicy policy =
146                           SerializationPolicy::kAssumeSerialized) const;
147 
148   Isolate* isolate() const;
149 
150   struct Hash {
151     size_t operator()(const ObjectRef& ref) const {
152       return base::hash_combine(ref.object().address());
153     }
154   };
155   struct Equal {
156     bool operator()(const ObjectRef& lhs, const ObjectRef& rhs) const {
157       return lhs.equals(rhs);
158     }
159   };
160 
161  protected:
162   JSHeapBroker* broker() const;
163   ObjectData* data() const;
164   ObjectData* data_;  // Should be used only by object() getters.
165 
166  private:
167   friend class FunctionTemplateInfoRef;
168   friend class JSArrayData;
169   friend class JSGlobalObjectData;
170   friend class JSGlobalObjectRef;
171   friend class JSHeapBroker;
172   friend class JSObjectData;
173   friend class StringData;
174 
175   friend std::ostream& operator<<(std::ostream& os, const ObjectRef& ref);
176 
177   JSHeapBroker* broker_;
178 };
179 
180 // Temporary class that carries information from a Map. We'd like to remove
181 // this class and use MapRef instead, but we can't as long as we support the
182 // kDisabled broker mode. That's because obtaining the MapRef via
183 // HeapObjectRef::map() requires a HandleScope when the broker is disabled.
184 // During OptimizeGraph we generally don't have a HandleScope, however. There
185 // are two places where we therefore use GetHeapObjectType() instead. Both that
186 // function and this class should eventually be removed.
187 class HeapObjectType {
188  public:
189   enum Flag : uint8_t { kUndetectable = 1 << 0, kCallable = 1 << 1 };
190 
191   using Flags = base::Flags<Flag>;
192 
HeapObjectType(InstanceType instance_type,Flags flags,OddballType oddball_type)193   HeapObjectType(InstanceType instance_type, Flags flags,
194                  OddballType oddball_type)
195       : instance_type_(instance_type),
196         oddball_type_(oddball_type),
197         flags_(flags) {
198     DCHECK_EQ(instance_type == ODDBALL_TYPE,
199               oddball_type != OddballType::kNone);
200   }
201 
oddball_type()202   OddballType oddball_type() const { return oddball_type_; }
instance_type()203   InstanceType instance_type() const { return instance_type_; }
flags()204   Flags flags() const { return flags_; }
205 
is_callable()206   bool is_callable() const { return flags_ & kCallable; }
is_undetectable()207   bool is_undetectable() const { return flags_ & kUndetectable; }
208 
209  private:
210   InstanceType const instance_type_;
211   OddballType const oddball_type_;
212   Flags const flags_;
213 };
214 
215 // Constructors are carefully defined such that we do a type check on
216 // the outermost Ref class in the inheritance chain only.
217 #define DEFINE_REF_CONSTRUCTOR(name, base)                                  \
218   name##Ref(JSHeapBroker* broker, Handle<Object> object,                    \
219             bool check_type = true)                                         \
220       : base(broker, object, false) {                                       \
221     if (check_type) {                                                       \
222       CHECK(Is##name());                                                    \
223     }                                                                       \
224   }                                                                         \
225   name##Ref(JSHeapBroker* broker, ObjectData* data, bool check_type = true) \
226       : base(broker, data, false) {                                         \
227     if (check_type) {                                                       \
228       CHECK(Is##name());                                                    \
229     }                                                                       \
230   }
231 
232 class HeapObjectRef : public ObjectRef {
233  public:
234   DEFINE_REF_CONSTRUCTOR(HeapObject, ObjectRef)
235 
236   Handle<HeapObject> object() const;
237 
238   MapRef map() const;
239 
240   // See the comment on the HeapObjectType class.
241   HeapObjectType GetHeapObjectType() const;
242 };
243 
244 class PropertyCellRef : public HeapObjectRef {
245  public:
246   DEFINE_REF_CONSTRUCTOR(PropertyCell, HeapObjectRef)
247 
248   Handle<PropertyCell> object() const;
249 
250   PropertyDetails property_details() const;
251 
252   void Serialize();
253   ObjectRef value() const;
254 };
255 
256 class JSReceiverRef : public HeapObjectRef {
257  public:
258   DEFINE_REF_CONSTRUCTOR(JSReceiver, HeapObjectRef)
259 
260   Handle<JSReceiver> object() const;
261 };
262 
263 class JSObjectRef : public JSReceiverRef {
264  public:
265   DEFINE_REF_CONSTRUCTOR(JSObject, JSReceiverRef)
266 
267   Handle<JSObject> object() const;
268 
269   uint64_t RawFastDoublePropertyAsBitsAt(FieldIndex index) const;
270   double RawFastDoublePropertyAt(FieldIndex index) const;
271   ObjectRef RawFastPropertyAt(FieldIndex index) const;
272 
273   // Return the value of the property identified by the field {index}
274   // if {index} is known to be an own data property of the object.
275   base::Optional<ObjectRef> GetOwnDataProperty(
276       Representation field_representation, FieldIndex index,
277       SerializationPolicy policy =
278           SerializationPolicy::kAssumeSerialized) const;
279   FixedArrayBaseRef elements() const;
280   void SerializeElements();
281   void EnsureElementsTenured();
282   ElementsKind GetElementsKind() const;
283 
284   void SerializeObjectCreateMap();
285   base::Optional<MapRef> GetObjectCreateMap() const;
286 };
287 
288 class JSDataViewRef : public JSObjectRef {
289  public:
290   DEFINE_REF_CONSTRUCTOR(JSDataView, JSObjectRef)
291 
292   Handle<JSDataView> object() const;
293 
294   size_t byte_length() const;
295   size_t byte_offset() const;
296 };
297 
298 class JSBoundFunctionRef : public JSObjectRef {
299  public:
300   DEFINE_REF_CONSTRUCTOR(JSBoundFunction, JSObjectRef)
301 
302   Handle<JSBoundFunction> object() const;
303 
304   void Serialize();
305   bool serialized() const;
306 
307   // The following are available only after calling Serialize().
308   JSReceiverRef bound_target_function() const;
309   ObjectRef bound_this() const;
310   FixedArrayRef bound_arguments() const;
311 };
312 
313 class V8_EXPORT_PRIVATE JSFunctionRef : public JSObjectRef {
314  public:
315   DEFINE_REF_CONSTRUCTOR(JSFunction, JSObjectRef)
316 
317   Handle<JSFunction> object() const;
318 
319   bool has_feedback_vector() const;
320   bool has_initial_map() const;
321   bool has_prototype() const;
322   bool PrototypeRequiresRuntimeLookup() const;
323 
324   void Serialize();
325   bool serialized() const;
326 
327   // The following are available only after calling Serialize().
328   ObjectRef prototype() const;
329   MapRef initial_map() const;
330   ContextRef context() const;
331   NativeContextRef native_context() const;
332   SharedFunctionInfoRef shared() const;
333   FeedbackVectorRef feedback_vector() const;
334   int InitialMapInstanceSizeWithMinSlack() const;
335 };
336 
337 class JSRegExpRef : public JSObjectRef {
338  public:
339   DEFINE_REF_CONSTRUCTOR(JSRegExp, JSObjectRef)
340 
341   Handle<JSRegExp> object() const;
342 
343   ObjectRef raw_properties_or_hash() const;
344   ObjectRef data() const;
345   ObjectRef source() const;
346   ObjectRef flags() const;
347   ObjectRef last_index() const;
348 
349   void SerializeAsRegExpBoilerplate();
350 };
351 
352 class HeapNumberRef : public HeapObjectRef {
353  public:
354   DEFINE_REF_CONSTRUCTOR(HeapNumber, HeapObjectRef)
355 
356   Handle<HeapNumber> object() const;
357 
358   double value() const;
359 };
360 
361 class ContextRef : public HeapObjectRef {
362  public:
363   DEFINE_REF_CONSTRUCTOR(Context, HeapObjectRef)
364 
365   Handle<Context> object() const;
366 
367   // {previous} decrements {depth} by 1 for each previous link successfully
368   // followed. If {depth} != 0 on function return, then it only got
369   // partway to the desired depth. If {serialize} is true, then
370   // {previous} will cache its findings.
371   ContextRef previous(size_t* depth,
372                       SerializationPolicy policy =
373                           SerializationPolicy::kAssumeSerialized) const;
374 
375   // Only returns a value if the index is valid for this ContextRef.
376   base::Optional<ObjectRef> get(
377       int index, SerializationPolicy policy =
378                      SerializationPolicy::kAssumeSerialized) const;
379 
380   // We only serialize the ScopeInfo if certain Promise
381   // builtins are called.
382   void SerializeScopeInfo();
383   base::Optional<ScopeInfoRef> scope_info() const;
384 };
385 
386 #define BROKER_COMPULSORY_NATIVE_CONTEXT_FIELDS(V)                    \
387   V(JSFunction, array_function)                                       \
388   V(JSFunction, boolean_function)                                     \
389   V(JSFunction, bigint_function)                                      \
390   V(JSFunction, number_function)                                      \
391   V(JSFunction, object_function)                                      \
392   V(JSFunction, promise_function)                                     \
393   V(JSFunction, promise_then)                                         \
394   V(JSFunction, regexp_function)                                      \
395   V(JSFunction, string_function)                                      \
396   V(JSFunction, symbol_function)                                      \
397   V(JSGlobalObject, global_object)                                    \
398   V(JSGlobalProxy, global_proxy_object)                               \
399   V(JSObject, promise_prototype)                                      \
400   V(Map, block_context_map)                                           \
401   V(Map, bound_function_with_constructor_map)                         \
402   V(Map, bound_function_without_constructor_map)                      \
403   V(Map, catch_context_map)                                           \
404   V(Map, eval_context_map)                                            \
405   V(Map, fast_aliased_arguments_map)                                  \
406   V(Map, function_context_map)                                        \
407   V(Map, initial_array_iterator_map)                                  \
408   V(Map, initial_string_iterator_map)                                 \
409   V(Map, iterator_result_map)                                         \
410   V(Map, js_array_holey_double_elements_map)                          \
411   V(Map, js_array_holey_elements_map)                                 \
412   V(Map, js_array_holey_smi_elements_map)                             \
413   V(Map, js_array_packed_double_elements_map)                         \
414   V(Map, js_array_packed_elements_map)                                \
415   V(Map, js_array_packed_smi_elements_map)                            \
416   V(Map, sloppy_arguments_map)                                        \
417   V(Map, slow_object_with_null_prototype_map)                         \
418   V(Map, strict_arguments_map)                                        \
419   V(Map, with_context_map)                                            \
420   V(ScriptContextTable, script_context_table)                         \
421   V(SharedFunctionInfo, promise_capability_default_reject_shared_fun) \
422   V(SharedFunctionInfo, promise_catch_finally_shared_fun)             \
423   V(SharedFunctionInfo, promise_then_finally_shared_fun)              \
424   V(SharedFunctionInfo, promise_capability_default_resolve_shared_fun)
425 
426 // Those are set by Bootstrapper::ExportFromRuntime, which may not yet have
427 // happened when Turbofan is invoked via --always-opt.
428 #define BROKER_OPTIONAL_NATIVE_CONTEXT_FIELDS(V) \
429   V(Map, async_function_object_map)              \
430   V(Map, map_key_iterator_map)                   \
431   V(Map, map_key_value_iterator_map)             \
432   V(Map, map_value_iterator_map)                 \
433   V(JSFunction, regexp_exec_function)            \
434   V(Map, set_key_value_iterator_map)             \
435   V(Map, set_value_iterator_map)
436 
437 #define BROKER_NATIVE_CONTEXT_FIELDS(V)      \
438   BROKER_COMPULSORY_NATIVE_CONTEXT_FIELDS(V) \
439   BROKER_OPTIONAL_NATIVE_CONTEXT_FIELDS(V)
440 
441 class NativeContextRef : public ContextRef {
442  public:
443   DEFINE_REF_CONSTRUCTOR(NativeContext, ContextRef)
444 
445   Handle<NativeContext> object() const;
446 
447   void Serialize();
448 
449 #define DECL_ACCESSOR(type, name) type##Ref name() const;
450   BROKER_NATIVE_CONTEXT_FIELDS(DECL_ACCESSOR)
451 #undef DECL_ACCESSOR
452 
453   ScopeInfoRef scope_info() const;
454   MapRef GetFunctionMapFromIndex(int index) const;
455   MapRef GetInitialJSArrayMap(ElementsKind kind) const;
456   base::Optional<JSFunctionRef> GetConstructorFunction(const MapRef& map) const;
457 };
458 
459 class NameRef : public HeapObjectRef {
460  public:
461   DEFINE_REF_CONSTRUCTOR(Name, HeapObjectRef)
462 
463   Handle<Name> object() const;
464 
465   bool IsUniqueName() const;
466 };
467 
468 class ScriptContextTableRef : public HeapObjectRef {
469  public:
470   DEFINE_REF_CONSTRUCTOR(ScriptContextTable, HeapObjectRef)
471 
472   Handle<ScriptContextTable> object() const;
473 
474   struct LookupResult {
475     ContextRef context;
476     bool immutable;
477     int index;
478   };
479 
480   base::Optional<LookupResult> lookup(const NameRef& name) const;
481 };
482 
483 class DescriptorArrayRef : public HeapObjectRef {
484  public:
485   DEFINE_REF_CONSTRUCTOR(DescriptorArray, HeapObjectRef)
486 
487   Handle<DescriptorArray> object() const;
488 };
489 
490 class FeedbackCellRef : public HeapObjectRef {
491  public:
492   DEFINE_REF_CONSTRUCTOR(FeedbackCell, HeapObjectRef)
493 
494   Handle<FeedbackCell> object() const;
495   base::Optional<SharedFunctionInfoRef> shared_function_info() const;
496   HeapObjectRef value() const;
497 };
498 
499 class FeedbackVectorRef : public HeapObjectRef {
500  public:
501   DEFINE_REF_CONSTRUCTOR(FeedbackVector, HeapObjectRef)
502 
503   Handle<FeedbackVector> object() const;
504 
505   SharedFunctionInfoRef shared_function_info() const;
506   double invocation_count() const;
507 
508   void Serialize();
509   bool serialized() const;
510   FeedbackCellRef GetClosureFeedbackCell(int index) const;
511 };
512 
513 class CallHandlerInfoRef : public HeapObjectRef {
514  public:
515   DEFINE_REF_CONSTRUCTOR(CallHandlerInfo, HeapObjectRef)
516 
517   Handle<CallHandlerInfo> object() const;
518 
519   Address callback() const;
520 
521   void Serialize();
522   ObjectRef data() const;
523 };
524 
525 class AccessorInfoRef : public HeapObjectRef {
526  public:
527   DEFINE_REF_CONSTRUCTOR(AccessorInfo, HeapObjectRef)
528 
529   Handle<AccessorInfo> object() const;
530 };
531 
532 class AllocationSiteRef : public HeapObjectRef {
533  public:
534   DEFINE_REF_CONSTRUCTOR(AllocationSite, HeapObjectRef)
535 
536   Handle<AllocationSite> object() const;
537 
538   bool PointsToLiteral() const;
539   AllocationType GetAllocationType() const;
540   ObjectRef nested_site() const;
541 
542   // {IsFastLiteral} determines whether the given array or object literal
543   // boilerplate satisfies all limits to be considered for fast deep-copying
544   // and computes the total size of all objects that are part of the graph.
545   //
546   // If PointsToLiteral() is false, then IsFastLiteral() is also false.
547   bool IsFastLiteral() const;
548 
549   void SerializeBoilerplate();
550 
551   // We only serialize boilerplate if IsFastLiteral is true.
552   base::Optional<JSObjectRef> boilerplate() const;
553 
554   ElementsKind GetElementsKind() const;
555   bool CanInlineCall() const;
556 };
557 
558 class BigIntRef : public HeapObjectRef {
559  public:
560   DEFINE_REF_CONSTRUCTOR(BigInt, HeapObjectRef)
561 
562   Handle<BigInt> object() const;
563 
564   uint64_t AsUint64() const;
565 };
566 
567 class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
568  public:
569   DEFINE_REF_CONSTRUCTOR(Map, HeapObjectRef)
570 
571   Handle<Map> object() const;
572 
573   int instance_size() const;
574   InstanceType instance_type() const;
575   int GetInObjectProperties() const;
576   int GetInObjectPropertiesStartInWords() const;
577   int NumberOfOwnDescriptors() const;
578   int GetInObjectPropertyOffset(int index) const;
579   int constructor_function_index() const;
580   int NextFreePropertyIndex() const;
581   int UnusedPropertyFields() const;
582   ElementsKind elements_kind() const;
583   bool is_stable() const;
584   bool is_extensible() const;
585   bool is_constructor() const;
586   bool has_prototype_slot() const;
587   bool is_access_check_needed() const;
588   bool is_deprecated() const;
589   bool CanBeDeprecated() const;
590   bool CanTransition() const;
591   bool IsInobjectSlackTrackingInProgress() const;
592   bool is_dictionary_map() const;
593   bool IsFixedCowArrayMap() const;
594   bool IsPrimitiveMap() const;
595   bool is_undetectable() const;
596   bool is_callable() const;
597   bool has_indexed_interceptor() const;
598   bool is_migration_target() const;
599   bool supports_fast_array_iteration() const;
600   bool supports_fast_array_resize() const;
601   bool is_abandoned_prototype_map() const;
602 
603   OddballType oddball_type() const;
604 
605 #define DEF_TESTER(Type, ...) bool Is##Type##Map() const;
606   INSTANCE_TYPE_CHECKERS(DEF_TESTER)
607 #undef DEF_TESTER
608 
609   void SerializeBackPointer();
610   HeapObjectRef GetBackPointer() const;
611 
612   void SerializePrototype();
613   bool serialized_prototype() const;
614   HeapObjectRef prototype() const;
615 
616   void SerializeForElementLoad();
617 
618   void SerializeForElementStore();
619   bool HasOnlyStablePrototypesWithFastElements(
620       ZoneVector<MapRef>* prototype_maps);
621 
622   // Concerning the underlying instance_descriptors:
623   void SerializeOwnDescriptors();
624   void SerializeOwnDescriptor(InternalIndex descriptor_index);
625   bool serialized_own_descriptor(InternalIndex descriptor_index) const;
626   MapRef FindFieldOwner(InternalIndex descriptor_index) const;
627   PropertyDetails GetPropertyDetails(InternalIndex descriptor_index) const;
628   NameRef GetPropertyKey(InternalIndex descriptor_index) const;
629   FieldIndex GetFieldIndexFor(InternalIndex descriptor_index) const;
630   ObjectRef GetFieldType(InternalIndex descriptor_index) const;
631   bool IsUnboxedDoubleField(InternalIndex descriptor_index) const;
632   base::Optional<ObjectRef> GetStrongValue(
633       InternalIndex descriptor_number) const;
634 
635   void SerializeRootMap();
636   base::Optional<MapRef> FindRootMap() const;
637 
638   // Available after calling JSFunctionRef::Serialize on a function that has
639   // this map as initial map.
640   ObjectRef GetConstructor() const;
641   base::Optional<MapRef> AsElementsKind(ElementsKind kind) const;
642 };
643 
644 struct HolderLookupResult {
645   HolderLookupResult(CallOptimization::HolderLookup lookup_ =
646                          CallOptimization::kHolderNotFound,
647                      base::Optional<JSObjectRef> holder_ = base::nullopt)
lookupHolderLookupResult648       : lookup(lookup_), holder(holder_) {}
649   CallOptimization::HolderLookup lookup;
650   base::Optional<JSObjectRef> holder;
651 };
652 
653 class FunctionTemplateInfoRef : public HeapObjectRef {
654  public:
655   DEFINE_REF_CONSTRUCTOR(FunctionTemplateInfo, HeapObjectRef)
656 
657   Handle<FunctionTemplateInfo> object() const;
658 
659   bool is_signature_undefined() const;
660   bool accept_any_receiver() const;
661   // The following returns true if the CallHandlerInfo is present.
662   bool has_call_code() const;
663 
664   void SerializeCallCode();
665   base::Optional<CallHandlerInfoRef> call_code() const;
666   Address c_function() const;
667   const CFunctionInfo* c_signature() const;
668 
669   HolderLookupResult LookupHolderOfExpectedType(
670       MapRef receiver_map,
671       SerializationPolicy policy = SerializationPolicy::kAssumeSerialized);
672 };
673 
674 class FixedArrayBaseRef : public HeapObjectRef {
675  public:
676   DEFINE_REF_CONSTRUCTOR(FixedArrayBase, HeapObjectRef)
677 
678   Handle<FixedArrayBase> object() const;
679 
680   int length() const;
681 };
682 
683 class ArrayBoilerplateDescriptionRef : public HeapObjectRef {
684  public:
685   using HeapObjectRef::HeapObjectRef;
686   Handle<ArrayBoilerplateDescription> object() const;
687 
688   int constants_elements_length() const;
689 };
690 
691 class ObjectBoilerplateDescriptionRef : public HeapObjectRef {
692  public:
693   using HeapObjectRef::HeapObjectRef;
694   Handle<ObjectBoilerplateDescription> object() const;
695 
696   int size() const;
697 };
698 
699 class FixedArrayRef : public FixedArrayBaseRef {
700  public:
701   DEFINE_REF_CONSTRUCTOR(FixedArray, FixedArrayBaseRef)
702 
703   Handle<FixedArray> object() const;
704 
705   ObjectRef get(int i) const;
706 };
707 
708 class FixedDoubleArrayRef : public FixedArrayBaseRef {
709  public:
710   DEFINE_REF_CONSTRUCTOR(FixedDoubleArray, FixedArrayBaseRef)
711 
712   Handle<FixedDoubleArray> object() const;
713 
714   double get_scalar(int i) const;
715   bool is_the_hole(int i) const;
716 };
717 
718 class BytecodeArrayRef : public FixedArrayBaseRef {
719  public:
720   DEFINE_REF_CONSTRUCTOR(BytecodeArray, FixedArrayBaseRef)
721 
722   Handle<BytecodeArray> object() const;
723 
724   int register_count() const;
725   int parameter_count() const;
726   interpreter::Register incoming_new_target_or_generator_register() const;
727 
728   // Bytecode access methods.
729   uint8_t get(int index) const;
730   Address GetFirstBytecodeAddress() const;
731 
732   // Source position table.
733   const byte* source_positions_address() const;
734   int source_positions_size() const;
735 
736   // Constant pool access.
737   Handle<Object> GetConstantAtIndex(int index) const;
738   bool IsConstantAtIndexSmi(int index) const;
739   Smi GetConstantAtIndexAsSmi(int index) const;
740 
741   // Exception handler table.
742   Address handler_table_address() const;
743   int handler_table_size() const;
744 
745   void SerializeForCompilation();
746 };
747 
748 class JSArrayRef : public JSObjectRef {
749  public:
750   DEFINE_REF_CONSTRUCTOR(JSArray, JSObjectRef)
751 
752   Handle<JSArray> object() const;
753 
754   ObjectRef length() const;
755 
756   // Return the element at key {index} if the array has a copy-on-write elements
757   // storage and {index} is known to be an own data property.
758   base::Optional<ObjectRef> GetOwnCowElement(
759       uint32_t index, SerializationPolicy policy =
760                           SerializationPolicy::kAssumeSerialized) const;
761 };
762 
763 class ScopeInfoRef : public HeapObjectRef {
764  public:
765   DEFINE_REF_CONSTRUCTOR(ScopeInfo, HeapObjectRef)
766 
767   Handle<ScopeInfo> object() const;
768 
769   int ContextLength() const;
770   bool HasOuterScopeInfo() const;
771   int Flags() const;
772   bool HasContextExtension() const;
773 
774   // Only serialized via SerializeScopeInfoChain.
775   ScopeInfoRef OuterScopeInfo() const;
776   void SerializeScopeInfoChain();
777 };
778 
779 #define BROKER_SFI_FIELDS(V)                             \
780   V(int, internal_formal_parameter_count)                \
781   V(bool, has_duplicate_parameters)                      \
782   V(int, function_map_index)                             \
783   V(FunctionKind, kind)                                  \
784   V(LanguageMode, language_mode)                         \
785   V(bool, native)                                        \
786   V(bool, HasBreakInfo)                                  \
787   V(bool, HasBuiltinId)                                  \
788   V(bool, construct_as_builtin)                          \
789   V(bool, HasBytecodeArray)                              \
790   V(bool, is_safe_to_skip_arguments_adaptor)             \
791   V(SharedFunctionInfo::Inlineability, GetInlineability) \
792   V(int, StartPosition)                                  \
793   V(bool, is_compiled)                                   \
794   V(bool, IsUserJavaScript)
795 
796 class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
797  public:
798   DEFINE_REF_CONSTRUCTOR(SharedFunctionInfo, HeapObjectRef)
799 
800   Handle<SharedFunctionInfo> object() const;
801 
802   int builtin_id() const;
803   int context_header_size() const;
804   BytecodeArrayRef GetBytecodeArray() const;
805 
806 #define DECL_ACCESSOR(type, name) type name() const;
BROKER_SFI_FIELDS(DECL_ACCESSOR)807   BROKER_SFI_FIELDS(DECL_ACCESSOR)
808 #undef DECL_ACCESSOR
809 
810   bool IsInlineable() const {
811     return GetInlineability() == SharedFunctionInfo::kIsInlineable;
812   }
813 
814   // Template objects may not be created at compilation time. This method
815   // wraps the retrieval of the template object and creates it if
816   // necessary.
817   JSArrayRef GetTemplateObject(
818       TemplateObjectDescriptionRef description, FeedbackSource const& source,
819       SerializationPolicy policy = SerializationPolicy::kAssumeSerialized);
820 
821   void SerializeFunctionTemplateInfo();
822   base::Optional<FunctionTemplateInfoRef> function_template_info() const;
823 
824   void SerializeScopeInfoChain();
825   ScopeInfoRef scope_info() const;
826 };
827 
828 class StringRef : public NameRef {
829  public:
830   DEFINE_REF_CONSTRUCTOR(String, NameRef)
831 
832   Handle<String> object() const;
833 
834   int length() const;
835   uint16_t GetFirstChar();
836   base::Optional<double> ToNumber();
837   bool IsSeqString() const;
838   bool IsExternalString() const;
839 };
840 
841 class SymbolRef : public NameRef {
842  public:
843   DEFINE_REF_CONSTRUCTOR(Symbol, NameRef)
844 
845   Handle<Symbol> object() const;
846 };
847 
848 class JSTypedArrayRef : public JSObjectRef {
849  public:
850   DEFINE_REF_CONSTRUCTOR(JSTypedArray, JSObjectRef)
851 
852   Handle<JSTypedArray> object() const;
853 
854   bool is_on_heap() const;
855   size_t length() const;
856   void* data_ptr() const;
857 
858   void Serialize();
859   bool serialized() const;
860 
861   HeapObjectRef buffer() const;
862 };
863 
864 class SourceTextModuleRef : public HeapObjectRef {
865  public:
866   DEFINE_REF_CONSTRUCTOR(SourceTextModule, HeapObjectRef)
867 
868   Handle<SourceTextModule> object() const;
869 
870   void Serialize();
871 
872   base::Optional<CellRef> GetCell(int cell_index) const;
873 };
874 
875 class TemplateObjectDescriptionRef : public HeapObjectRef {
876  public:
877   DEFINE_REF_CONSTRUCTOR(TemplateObjectDescription, HeapObjectRef)
878 
879   Handle<TemplateObjectDescription> object() const;
880 };
881 
882 class CellRef : public HeapObjectRef {
883  public:
884   DEFINE_REF_CONSTRUCTOR(Cell, HeapObjectRef)
885 
886   Handle<Cell> object() const;
887 
888   ObjectRef value() const;
889 };
890 
891 class JSGlobalObjectRef : public JSObjectRef {
892  public:
893   DEFINE_REF_CONSTRUCTOR(JSGlobalObject, JSObjectRef)
894 
895   Handle<JSGlobalObject> object() const;
896 
897   bool IsDetached() const;
898 
899   // If {serialize} is false:
900   //   If the property is known to exist as a property cell (on the global
901   //   object), return that property cell. Otherwise (not known to exist as a
902   //   property cell or known not to exist as a property cell) return nothing.
903   // If {serialize} is true:
904   //   Like above but potentially access the heap and serialize the necessary
905   //   information.
906   base::Optional<PropertyCellRef> GetPropertyCell(
907       NameRef const& name, SerializationPolicy policy =
908                                SerializationPolicy::kAssumeSerialized) const;
909 };
910 
911 class JSGlobalProxyRef : public JSObjectRef {
912  public:
913   DEFINE_REF_CONSTRUCTOR(JSGlobalProxy, JSObjectRef)
914 
915   Handle<JSGlobalProxy> object() const;
916 };
917 
918 class CodeRef : public HeapObjectRef {
919  public:
920   DEFINE_REF_CONSTRUCTOR(Code, HeapObjectRef)
921 
922   Handle<Code> object() const;
923 };
924 
925 class InternalizedStringRef : public StringRef {
926  public:
927   DEFINE_REF_CONSTRUCTOR(InternalizedString, StringRef)
928 
929   Handle<InternalizedString> object() const;
930 };
931 
932 #undef DEFINE_REF_CONSTRUCTOR
933 
934 }  // namespace compiler
935 }  // namespace internal
936 }  // namespace v8
937 
938 #endif  // V8_COMPILER_HEAP_REFS_H_
939