[ubsan] Port SmallOrderedHashTable and subclasses

to the new design.

Bug: v8:3770
Change-Id: Ic77a4f645a1ca3ed9be87690155e988723132471
Reviewed-on: https://chromium-review.googlesource.com/c/1350285Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57884}

src/handles.h

@@ -33,6 +33,9 @@ class ObjectPtr;
 class OrderedHashMap;
 class OrderedHashSet;
 class OrderedNameDictionary;
+class SmallOrderedHashMap;
+class SmallOrderedHashSet;
+class SmallOrderedNameDictionary;
 
 // ----------------------------------------------------------------------------
 // Base class for Handle instantiations.  Don't use directly.
@@ -160,6 +163,9 @@ class Handle final : public HandleBase {
             std::is_same<S, OrderedNameDictionary>::value ||
             std::is_same<S, ScriptContextTable>::value ||
             std::is_same<S, ScopeInfo>::value ||
+            std::is_same<S, SmallOrderedHashMap>::value ||
+            std::is_same<S, SmallOrderedHashSet>::value ||
+            std::is_same<S, SmallOrderedNameDictionary>::value ||
             std::is_same<S, String>::value ||
             std::is_same<S, Symbol>::value))>::type>
   V8_INLINE Handle(Handle<S> handle) : HandleBase(handle) {}

src/heap/objects-visiting.h

@@ -68,9 +68,9 @@ class WasmInstanceObject;
   V(SeqTwoByteString, SeqTwoByteString)                                        \
   V(SharedFunctionInfo, SharedFunctionInfo*)                                   \
   V(SlicedString, SlicedString)                                                \
-  V(SmallOrderedHashMap, SmallOrderedHashMap*)                                 \
-  V(SmallOrderedHashSet, SmallOrderedHashSet*)                                 \
-  V(SmallOrderedNameDictionary, SmallOrderedNameDictionary*)                   \
+  V(SmallOrderedHashMap, SmallOrderedHashMap)                                  \
+  V(SmallOrderedHashSet, SmallOrderedHashSet)                                  \
+  V(SmallOrderedNameDictionary, SmallOrderedNameDictionary)                    \
   V(Symbol, Symbol)                                                            \
   V(ThinString, ThinString)                                                    \
   V(TransitionArray, TransitionArray*)                                         \

src/objects-body-descriptors-inl.h

@@ -276,7 +276,7 @@ class SmallOrderedHashTable<Derived>::BodyDescriptor final
     : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(Map map, HeapObject* obj, int offset) {
-    Derived* table = reinterpret_cast<Derived*>(obj);
+    Derived table = Derived::cast(obj);
     if (offset < kDataTableStartOffset) return false;
     if (offset >= table->GetBucketsStartOffset()) return false;
     return IsValidSlotImpl(map, obj, offset);
@@ -285,7 +285,7 @@ class SmallOrderedHashTable<Derived>::BodyDescriptor final
   template <typename ObjectVisitor>
   static inline void IterateBody(Map map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    Derived* table = reinterpret_cast<Derived*>(obj);
+    Derived table = Derived::cast(obj);
 
     int offset = kDataTableStartOffset;
     int entry = 0;
@@ -298,7 +298,7 @@ class SmallOrderedHashTable<Derived>::BodyDescriptor final
   }
 
   static inline int SizeOf(Map map, HeapObject* obj) {
-    Derived* table = reinterpret_cast<Derived*>(obj);
+    Derived table = Derived::cast(obj);
     return table->SizeFor(table->Capacity());
   }
 };

src/objects-inl.h

@@ -487,6 +487,17 @@ OrderedNameDictionary::OrderedNameDictionary(Address ptr)
   SLOW_DCHECK(IsOrderedNameDictionary());
 }
 
+template <class Derived>
+SmallOrderedHashTable<Derived>::SmallOrderedHashTable(Address ptr)
+    : HeapObjectPtr(ptr) {}
+
+OBJECT_CONSTRUCTORS_IMPL(SmallOrderedHashSet,
+                         SmallOrderedHashTable<SmallOrderedHashSet>)
+OBJECT_CONSTRUCTORS_IMPL(SmallOrderedHashMap,
+                         SmallOrderedHashTable<SmallOrderedHashMap>)
+OBJECT_CONSTRUCTORS_IMPL(SmallOrderedNameDictionary,
+                         SmallOrderedHashTable<SmallOrderedNameDictionary>)
+
 OBJECT_CONSTRUCTORS_IMPL(RegExpMatchInfo, FixedArray)
 OBJECT_CONSTRUCTORS_IMPL(ScopeInfo, FixedArray)
 
@@ -522,9 +533,9 @@ CAST_ACCESSOR(PropertyCell)
 CAST_ACCESSOR2(RegExpMatchInfo)
 CAST_ACCESSOR2(ScopeInfo)
 CAST_ACCESSOR2(SimpleNumberDictionary)
-CAST_ACCESSOR(SmallOrderedHashMap)
-CAST_ACCESSOR(SmallOrderedHashSet)
-CAST_ACCESSOR(SmallOrderedNameDictionary)
+CAST_ACCESSOR2(SmallOrderedHashMap)
+CAST_ACCESSOR2(SmallOrderedHashSet)
+CAST_ACCESSOR2(SmallOrderedNameDictionary)
 CAST_ACCESSOR2(StringSet)
 CAST_ACCESSOR2(StringTable)
 CAST_ACCESSOR(Struct)
@@ -1579,15 +1590,15 @@ int HeapObject::SizeFromMap(Map map) const {
   }
   if (instance_type == SMALL_ORDERED_HASH_SET_TYPE) {
     return SmallOrderedHashSet::SizeFor(
-        reinterpret_cast<const SmallOrderedHashSet*>(this)->Capacity());
+        SmallOrderedHashSet::unchecked_cast(this)->Capacity());
   }
   if (instance_type == SMALL_ORDERED_HASH_MAP_TYPE) {
     return SmallOrderedHashMap::SizeFor(
-        reinterpret_cast<const SmallOrderedHashMap*>(this)->Capacity());
+        SmallOrderedHashMap::unchecked_cast(this)->Capacity());
   }
   if (instance_type == SMALL_ORDERED_NAME_DICTIONARY_TYPE) {
     return SmallOrderedNameDictionary::SizeFor(
-        reinterpret_cast<const SmallOrderedNameDictionary*>(this)->Capacity());
+        SmallOrderedNameDictionary::unchecked_cast(this)->Capacity());
   }
   if (instance_type == PROPERTY_ARRAY_TYPE) {
     return PropertyArray::SizeFor(

src/objects/heap-object-inl.h

@@ -48,6 +48,11 @@ ODDBALL_LIST(TYPE_CHECK_FORWARDER)
 
 bool ObjectPtr::IsHashTableBase() const { return IsHashTable(); }
 
+bool ObjectPtr::IsSmallOrderedHashTable() const {
+  return IsSmallOrderedHashSet() || IsSmallOrderedHashMap() ||
+         IsSmallOrderedNameDictionary();
+}
+
 double ObjectPtr::Number() const {
   return reinterpret_cast<Object*>(ptr())->Number();
 }

src/objects/heap-object.h

@@ -57,6 +57,7 @@ class ObjectPtr {
   ODDBALL_LIST(IS_TYPE_FUNCTION_DECL)
 #undef IS_TYPE_FUNCTION_DECL
   inline bool IsHashTableBase() const;
+  V8_INLINE bool IsSmallOrderedHashTable() const;
 
   inline bool IsObject() const { return true; }
   inline double Number() const;
@@ -182,6 +183,7 @@ class HeapObjectPtr : public ObjectPtr {
 #endif
 
   static const int kMapOffset = HeapObject::kMapOffset;
+  static const int kHeaderSize = HeapObject::kHeaderSize;
 
   inline Address GetFieldAddress(int field_offset) const;
 

src/objects/ordered-hash-table.cc

@@ -460,8 +460,8 @@ void SmallOrderedHashTable<Derived>::Initialize(Isolate* isolate,
   memset(reinterpret_cast<byte*>(hashtable_start), kNotFound,
          num_buckets + num_chains);
 
-  if (Heap::InNewSpace(this)) {
-    MemsetPointer(RawField(this, kDataTableStartOffset),
+  if (Heap::InNewSpace(*this)) {
+    MemsetPointer(RawField(kDataTableStartOffset),
                   ReadOnlyRoots(isolate).the_hole_value(),
                   capacity * Derived::kEntrySize);
   } else {
@@ -604,7 +604,7 @@ bool SmallOrderedHashTable<Derived>::HasKey(Isolate* isolate,
 }
 
 template <class Derived>
-bool SmallOrderedHashTable<Derived>::Delete(Isolate* isolate, Derived* table,
+bool SmallOrderedHashTable<Derived>::Delete(Isolate* isolate, Derived table,
                                             Object* key) {
   DisallowHeapAllocation no_gc;
   int entry = table->FindEntry(isolate, key);
@@ -748,9 +748,9 @@ template void SmallOrderedHashTable<SmallOrderedHashMap>::Initialize(
     Isolate* isolate, int capacity);
 
 template bool SmallOrderedHashTable<SmallOrderedHashMap>::Delete(
-    Isolate* isolate, SmallOrderedHashMap* table, Object* key);
+    Isolate* isolate, SmallOrderedHashMap table, Object* key);
 template bool SmallOrderedHashTable<SmallOrderedHashSet>::Delete(
-    Isolate* isolate, SmallOrderedHashSet* table, Object* key);
+    Isolate* isolate, SmallOrderedHashSet table, Object* key);
 
 template void SmallOrderedHashTable<SmallOrderedNameDictionary>::Initialize(
     Isolate* isolate, int capacity);

src/objects/ordered-hash-table.h

@@ -272,7 +272,7 @@ class OrderedHashMap : public OrderedHashTable<OrderedHashMap, 2> {
 //    [45] : empty
 //
 template <class Derived>
-class SmallOrderedHashTable : public HeapObject {
+class SmallOrderedHashTable : public HeapObjectPtr {
  public:
   // Offset points to a relative location in the table
   typedef int Offset;
@@ -291,7 +291,7 @@ class SmallOrderedHashTable : public HeapObject {
 
   // Returns a true value if the table contains the key and
   // the key has been deleted. This does not shrink the table.
-  static bool Delete(Isolate* isolate, Derived* table, Object* key);
+  static bool Delete(Isolate* isolate, Derived table, Object* key);
 
   // Returns an SmallOrderedHashTable (possibly |table|) with enough
   // space to add at least one new element. Returns empty handle if
@@ -497,11 +497,13 @@ class SmallOrderedHashTable : public HeapObject {
   friend class OrderedHashMapHandler;
   friend class OrderedHashSetHandler;
   friend class CodeStubAssembler;
+
+  OBJECT_CONSTRUCTORS(SmallOrderedHashTable, HeapObjectPtr)
 };
 
 class SmallOrderedHashSet : public SmallOrderedHashTable<SmallOrderedHashSet> {
  public:
-  DECL_CAST(SmallOrderedHashSet)
+  DECL_CAST2(SmallOrderedHashSet)
 
   DECL_PRINTER(SmallOrderedHashSet)
 
@@ -516,11 +518,14 @@ class SmallOrderedHashSet : public SmallOrderedHashTable<SmallOrderedHashSet> {
                                               Handle<Object> key);
   static inline bool Is(Handle<HeapObject> table);
   static inline RootIndex GetMapRootIndex();
+
+  OBJECT_CONSTRUCTORS(SmallOrderedHashSet,
+                      SmallOrderedHashTable<SmallOrderedHashSet>)
 };
 
 class SmallOrderedHashMap : public SmallOrderedHashTable<SmallOrderedHashMap> {
  public:
-  DECL_CAST(SmallOrderedHashMap)
+  DECL_CAST2(SmallOrderedHashMap)
 
   DECL_PRINTER(SmallOrderedHashMap)
 
@@ -537,6 +542,9 @@ class SmallOrderedHashMap : public SmallOrderedHashTable<SmallOrderedHashMap> {
                                               Handle<Object> value);
   static inline bool Is(Handle<HeapObject> table);
   static inline RootIndex GetMapRootIndex();
+
+  OBJECT_CONSTRUCTORS(SmallOrderedHashMap,
+                      SmallOrderedHashTable<SmallOrderedHashMap>)
 };
 
 // TODO(gsathya): Rename this to OrderedHashTable, after we rename
@@ -612,7 +620,7 @@ class OrderedNameDictionary
 class SmallOrderedNameDictionary
     : public SmallOrderedHashTable<SmallOrderedNameDictionary> {
  public:
-  DECL_CAST(SmallOrderedNameDictionary)
+  DECL_CAST2(SmallOrderedNameDictionary)
 
   DECL_PRINTER(SmallOrderedNameDictionary)
 
@@ -640,6 +648,9 @@ class SmallOrderedNameDictionary
       Isolate* isolate, Handle<SmallOrderedNameDictionary> table,
       Handle<Name> key, Handle<Object> value, PropertyDetails details);
   static inline RootIndex GetMapRootIndex();
+
+  OBJECT_CONSTRUCTORS(SmallOrderedNameDictionary,
+                      SmallOrderedHashTable<SmallOrderedNameDictionary>)
 };
 
 class JSCollectionIterator : public JSObject {