// Copyright 2015 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include <ostream> #include "src/accessors.h" #include "src/compilation-dependencies.h" #include "src/compiler/access-info.h" #include "src/compiler/type-cache.h" #include "src/field-index-inl.h" #include "src/field-type.h" #include "src/ic/call-optimization.h" #include "src/objects-inl.h" namespace v8 { namespace internal { namespace compiler { namespace { bool CanInlineElementAccess(Handle<Map> map) { if (!map->IsJSObjectMap()) return false; if (map->is_access_check_needed()) return false; if (map->has_indexed_interceptor()) return false; ElementsKind const elements_kind = map->elements_kind(); if (IsFastElementsKind(elements_kind)) return true; if (IsFixedTypedArrayElementsKind(elements_kind)) return true; return false; } bool CanInlinePropertyAccess(Handle<Map> map) { // We can inline property access to prototypes of all primitives, except // the special Oddball ones that have no wrapper counterparts (i.e. Null, // Undefined and TheHole). STATIC_ASSERT(ODDBALL_TYPE == LAST_PRIMITIVE_TYPE); if (map->IsBooleanMap()) return true; if (map->instance_type() < LAST_PRIMITIVE_TYPE) return true; return map->IsJSObjectMap() && !map->is_dictionary_map() && !map->has_named_interceptor() && // TODO(verwaest): Whitelist contexts to which we have access. !map->is_access_check_needed(); } } // namespace std::ostream& operator<<(std::ostream& os, AccessMode access_mode) { switch (access_mode) { case AccessMode::kLoad: return os << "Load"; case AccessMode::kStore: return os << "Store"; case AccessMode::kStoreInLiteral: return os << "StoreInLiteral"; } UNREACHABLE(); return os; } ElementAccessInfo::ElementAccessInfo() {} ElementAccessInfo::ElementAccessInfo(MapList const& receiver_maps, ElementsKind elements_kind) : elements_kind_(elements_kind), receiver_maps_(receiver_maps) {} // static PropertyAccessInfo PropertyAccessInfo::NotFound(MapList const& receiver_maps, MaybeHandle<JSObject> holder) { return PropertyAccessInfo(holder, receiver_maps); } // static PropertyAccessInfo PropertyAccessInfo::DataConstant( MapList const& receiver_maps, Handle<Object> constant, MaybeHandle<JSObject> holder) { return PropertyAccessInfo(kDataConstant, holder, constant, receiver_maps); } // static PropertyAccessInfo PropertyAccessInfo::DataField( PropertyConstness constness, MapList const& receiver_maps, FieldIndex field_index, MachineRepresentation field_representation, Type* field_type, MaybeHandle<Map> field_map, MaybeHandle<JSObject> holder, MaybeHandle<Map> transition_map) { Kind kind = constness == kConst ? kDataConstantField : kDataField; return PropertyAccessInfo(kind, holder, transition_map, field_index, field_representation, field_type, field_map, receiver_maps); } // static PropertyAccessInfo PropertyAccessInfo::AccessorConstant( MapList const& receiver_maps, Handle<Object> constant, MaybeHandle<JSObject> holder) { return PropertyAccessInfo(kAccessorConstant, holder, constant, receiver_maps); } // static PropertyAccessInfo PropertyAccessInfo::Generic(MapList const& receiver_maps) { return PropertyAccessInfo(kGeneric, MaybeHandle<JSObject>(), Handle<Object>(), receiver_maps); } PropertyAccessInfo::PropertyAccessInfo() : kind_(kInvalid), field_representation_(MachineRepresentation::kNone), field_type_(Type::None()) {} PropertyAccessInfo::PropertyAccessInfo(MaybeHandle<JSObject> holder, MapList const& receiver_maps) : kind_(kNotFound), receiver_maps_(receiver_maps), holder_(holder), field_representation_(MachineRepresentation::kNone), field_type_(Type::None()) {} PropertyAccessInfo::PropertyAccessInfo(Kind kind, MaybeHandle<JSObject> holder, Handle<Object> constant, MapList const& receiver_maps) : kind_(kind), receiver_maps_(receiver_maps), constant_(constant), holder_(holder), field_representation_(MachineRepresentation::kNone), field_type_(Type::Any()) {} PropertyAccessInfo::PropertyAccessInfo( Kind kind, MaybeHandle<JSObject> holder, MaybeHandle<Map> transition_map, FieldIndex field_index, MachineRepresentation field_representation, Type* field_type, MaybeHandle<Map> field_map, MapList const& receiver_maps) : kind_(kind), receiver_maps_(receiver_maps), transition_map_(transition_map), holder_(holder), field_index_(field_index), field_representation_(field_representation), field_type_(field_type), field_map_(field_map) {} bool PropertyAccessInfo::Merge(PropertyAccessInfo const* that) { if (this->kind_ != that->kind_) return false; if (this->holder_.address() != that->holder_.address()) return false; switch (this->kind_) { case kInvalid: break; case kDataField: case kDataConstantField: { // Check if we actually access the same field. if (this->kind_ == that->kind_ && this->transition_map_.address() == that->transition_map_.address() && this->field_index_ == that->field_index_ && this->field_map_.address() == that->field_map_.address() && this->field_type_->Is(that->field_type_) && that->field_type_->Is(this->field_type_) && this->field_representation_ == that->field_representation_) { this->receiver_maps_.insert(this->receiver_maps_.end(), that->receiver_maps_.begin(), that->receiver_maps_.end()); return true; } return false; } case kDataConstant: case kAccessorConstant: { // Check if we actually access the same constant. if (this->constant_.address() == that->constant_.address()) { this->receiver_maps_.insert(this->receiver_maps_.end(), that->receiver_maps_.begin(), that->receiver_maps_.end()); return true; } return false; } case kNotFound: case kGeneric: { this->receiver_maps_.insert(this->receiver_maps_.end(), that->receiver_maps_.begin(), that->receiver_maps_.end()); return true; } } UNREACHABLE(); return false; } AccessInfoFactory::AccessInfoFactory(CompilationDependencies* dependencies, Handle<Context> native_context, Zone* zone) : dependencies_(dependencies), native_context_(native_context), isolate_(native_context->GetIsolate()), type_cache_(TypeCache::Get()), zone_(zone) { DCHECK(native_context->IsNativeContext()); } bool AccessInfoFactory::ComputeElementAccessInfo( Handle<Map> map, AccessMode access_mode, ElementAccessInfo* access_info) { // Check if it is safe to inline element access for the {map}. if (!CanInlineElementAccess(map)) return false; ElementsKind const elements_kind = map->elements_kind(); *access_info = ElementAccessInfo(MapList{map}, elements_kind); return true; } bool AccessInfoFactory::ComputeElementAccessInfos( MapHandleList const& maps, AccessMode access_mode, ZoneVector<ElementAccessInfo>* access_infos) { // Collect possible transition targets. MapHandleList possible_transition_targets(maps.length()); for (Handle<Map> map : maps) { if (Map::TryUpdate(map).ToHandle(&map)) { if (CanInlineElementAccess(map) && IsFastElementsKind(map->elements_kind()) && GetInitialFastElementsKind() != map->elements_kind()) { possible_transition_targets.Add(map); } } } // Separate the actual receiver maps and the possible transition sources. MapHandleList receiver_maps(maps.length()); MapTransitionList transitions(maps.length()); for (Handle<Map> map : maps) { if (Map::TryUpdate(map).ToHandle(&map)) { Map* transition_target = map->FindElementsKindTransitionedMap(&possible_transition_targets); if (transition_target == nullptr) { receiver_maps.Add(map); } else { transitions.push_back(std::make_pair(map, handle(transition_target))); } } } for (Handle<Map> receiver_map : receiver_maps) { // Compute the element access information. ElementAccessInfo access_info; if (!ComputeElementAccessInfo(receiver_map, access_mode, &access_info)) { return false; } // Collect the possible transitions for the {receiver_map}. for (auto transition : transitions) { if (transition.second.is_identical_to(receiver_map)) { access_info.transitions().push_back(transition); } } // Schedule the access information. access_infos->push_back(access_info); } return true; } bool AccessInfoFactory::ComputePropertyAccessInfo( Handle<Map> map, Handle<Name> name, AccessMode access_mode, PropertyAccessInfo* access_info) { // Check if it is safe to inline property access for the {map}. if (!CanInlinePropertyAccess(map)) return false; // Compute the receiver type. Handle<Map> receiver_map = map; // Property lookups require the name to be internalized. name = isolate()->factory()->InternalizeName(name); // We support fast inline cases for certain JSObject getters. if (access_mode == AccessMode::kLoad && LookupSpecialFieldAccessor(map, name, access_info)) { return true; } MaybeHandle<JSObject> holder; do { // Lookup the named property on the {map}. Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate()); int const number = descriptors->SearchWithCache(isolate(), *name, *map); if (number != DescriptorArray::kNotFound) { PropertyDetails const details = descriptors->GetDetails(number); if (access_mode == AccessMode::kStore || access_mode == AccessMode::kStoreInLiteral) { // Don't bother optimizing stores to read-only properties. if (details.IsReadOnly()) { return false; } // Check for store to data property on a prototype. if (details.kind() == kData && !holder.is_null()) { // Store to property not found on the receiver but on a prototype, we // need to transition to a new data property. // Implemented according to ES6 section 9.1.9 [[Set]] (P, V, Receiver) return LookupTransition(receiver_map, name, holder, access_info); } } if (details.location() == kField) { if (details.kind() == kData) { int index = descriptors->GetFieldIndex(number); Representation details_representation = details.representation(); FieldIndex field_index = FieldIndex::ForPropertyIndex( *map, index, details_representation.IsDouble()); Type* field_type = Type::NonInternal(); MachineRepresentation field_representation = MachineRepresentation::kTagged; MaybeHandle<Map> field_map; if (details_representation.IsSmi()) { field_type = Type::SignedSmall(); field_representation = MachineRepresentation::kTaggedSigned; } else if (details_representation.IsDouble()) { field_type = type_cache_.kFloat64; field_representation = MachineRepresentation::kFloat64; } else if (details_representation.IsHeapObject()) { // Extract the field type from the property details (make sure its // representation is TaggedPointer to reflect the heap object case). field_representation = MachineRepresentation::kTaggedPointer; Handle<FieldType> descriptors_field_type( descriptors->GetFieldType(number), isolate()); if (descriptors_field_type->IsNone()) { // Store is not safe if the field type was cleared. if (access_mode == AccessMode::kStore) return false; // The field type was cleared by the GC, so we don't know anything // about the contents now. } else if (descriptors_field_type->IsClass()) { // Add proper code dependencies in case of stable field map(s). Handle<Map> field_owner_map(map->FindFieldOwner(number), isolate()); dependencies()->AssumeFieldOwner(field_owner_map); // Remember the field map, and try to infer a useful type. field_type = Type::For(descriptors_field_type->AsClass()); field_map = descriptors_field_type->AsClass(); } } *access_info = PropertyAccessInfo::DataField( details.constness(), MapList{receiver_map}, field_index, field_representation, field_type, field_map, holder); return true; } else { DCHECK_EQ(kAccessor, details.kind()); // TODO(turbofan): Add support for general accessors? return false; } } else { DCHECK_EQ(kDescriptor, details.location()); if (details.kind() == kData) { DCHECK(!FLAG_track_constant_fields); *access_info = PropertyAccessInfo::DataConstant( MapList{receiver_map}, handle(descriptors->GetValue(number), isolate()), holder); return true; } else { DCHECK_EQ(kAccessor, details.kind()); Handle<Object> accessors(descriptors->GetValue(number), isolate()); if (!accessors->IsAccessorPair()) return false; Handle<Object> accessor( access_mode == AccessMode::kLoad ? Handle<AccessorPair>::cast(accessors)->getter() : Handle<AccessorPair>::cast(accessors)->setter(), isolate()); if (!accessor->IsJSFunction()) { CallOptimization optimization(accessor); if (!optimization.is_simple_api_call()) { return false; } if (V8_UNLIKELY(FLAG_runtime_stats)) return false; } if (access_mode == AccessMode::kLoad) { Handle<Name> cached_property_name; if (FunctionTemplateInfo::TryGetCachedPropertyName(isolate(), accessor) .ToHandle(&cached_property_name)) { if (ComputePropertyAccessInfo(map, cached_property_name, access_mode, access_info)) { return true; } } } *access_info = PropertyAccessInfo::AccessorConstant( MapList{receiver_map}, accessor, holder); return true; } } UNREACHABLE(); return false; } // Don't search on the prototype chain for special indices in case of // integer indexed exotic objects (see ES6 section 9.4.5). if (map->IsJSTypedArrayMap() && name->IsString() && IsSpecialIndex(isolate()->unicode_cache(), String::cast(*name))) { return false; } // Don't search on the prototype when storing in literals if (access_mode == AccessMode::kStoreInLiteral) { return LookupTransition(receiver_map, name, holder, access_info); } // Don't lookup private symbols on the prototype chain. if (name->IsPrivate()) return false; // Walk up the prototype chain. if (!map->prototype()->IsJSObject()) { // Perform the implicit ToObject for primitives here. // Implemented according to ES6 section 7.3.2 GetV (V, P). Handle<JSFunction> constructor; if (Map::GetConstructorFunction(map, native_context()) .ToHandle(&constructor)) { map = handle(constructor->initial_map(), isolate()); DCHECK(map->prototype()->IsJSObject()); } else if (map->prototype()->IsNull(isolate())) { // Store to property not found on the receiver or any prototype, we need // to transition to a new data property. // Implemented according to ES6 section 9.1.9 [[Set]] (P, V, Receiver) if (access_mode == AccessMode::kStore) { return LookupTransition(receiver_map, name, holder, access_info); } // The property was not found, return undefined or throw depending // on the language mode of the load operation. // Implemented according to ES6 section 9.1.8 [[Get]] (P, Receiver) *access_info = PropertyAccessInfo::NotFound(MapList{receiver_map}, holder); return true; } else { return false; } } Handle<JSObject> map_prototype(JSObject::cast(map->prototype()), isolate()); if (map_prototype->map()->is_deprecated()) { // Try to migrate the prototype object so we don't embed the deprecated // map into the optimized code. JSObject::TryMigrateInstance(map_prototype); } map = handle(map_prototype->map(), isolate()); holder = map_prototype; } while (CanInlinePropertyAccess(map)); return false; } bool AccessInfoFactory::ComputePropertyAccessInfos( MapHandleList const& maps, Handle<Name> name, AccessMode access_mode, ZoneVector<PropertyAccessInfo>* access_infos) { for (Handle<Map> map : maps) { if (Map::TryUpdate(map).ToHandle(&map)) { PropertyAccessInfo access_info; if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) { return false; } // Try to merge the {access_info} with an existing one. bool merged = false; for (PropertyAccessInfo& other_info : *access_infos) { if (other_info.Merge(&access_info)) { merged = true; break; } } if (!merged) access_infos->push_back(access_info); } } return true; } bool AccessInfoFactory::LookupSpecialFieldAccessor( Handle<Map> map, Handle<Name> name, PropertyAccessInfo* access_info) { // Check for special JSObject field accessors. int offset; if (Accessors::IsJSObjectFieldAccessor(map, name, &offset)) { FieldIndex field_index = FieldIndex::ForInObjectOffset(offset); Type* field_type = Type::NonInternal(); MachineRepresentation field_representation = MachineRepresentation::kTagged; if (map->IsStringMap()) { DCHECK(Name::Equals(factory()->length_string(), name)); // The String::length property is always a smi in the range // [0, String::kMaxLength]. field_type = type_cache_.kStringLengthType; field_representation = MachineRepresentation::kTaggedSigned; } else if (map->IsJSArrayMap()) { DCHECK(Name::Equals(factory()->length_string(), name)); // The JSArray::length property is a smi in the range // [0, FixedDoubleArray::kMaxLength] in case of fast double // elements, a smi in the range [0, FixedArray::kMaxLength] // in case of other fast elements, and [0, kMaxUInt32] in // case of other arrays. if (IsFastDoubleElementsKind(map->elements_kind())) { field_type = type_cache_.kFixedDoubleArrayLengthType; field_representation = MachineRepresentation::kTaggedSigned; } else if (IsFastElementsKind(map->elements_kind())) { field_type = type_cache_.kFixedArrayLengthType; field_representation = MachineRepresentation::kTaggedSigned; } else { field_type = type_cache_.kJSArrayLengthType; } } // Special fields are always mutable. *access_info = PropertyAccessInfo::DataField( kMutable, MapList{map}, field_index, field_representation, field_type); return true; } return false; } bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name, MaybeHandle<JSObject> holder, PropertyAccessInfo* access_info) { // Check if the {map} has a data transition with the given {name}. if (map->unused_property_fields() == 0) { *access_info = PropertyAccessInfo::Generic(MapList{map}); return true; } Handle<Map> transition_map; if (TransitionArray::SearchTransition(map, kData, name, NONE) .ToHandle(&transition_map)) { int const number = transition_map->LastAdded(); PropertyDetails const details = transition_map->instance_descriptors()->GetDetails(number); // Don't bother optimizing stores to read-only properties. if (details.IsReadOnly()) return false; // TODO(bmeurer): Handle transition to data constant? if (details.location() != kField) return false; int const index = details.field_index(); Representation details_representation = details.representation(); FieldIndex field_index = FieldIndex::ForPropertyIndex( *transition_map, index, details_representation.IsDouble()); Type* field_type = Type::NonInternal(); MaybeHandle<Map> field_map; MachineRepresentation field_representation = MachineRepresentation::kTagged; if (details_representation.IsSmi()) { field_type = Type::SignedSmall(); field_representation = MachineRepresentation::kTaggedSigned; } else if (details_representation.IsDouble()) { field_type = type_cache_.kFloat64; field_representation = MachineRepresentation::kFloat64; } else if (details_representation.IsHeapObject()) { // Extract the field type from the property details (make sure its // representation is TaggedPointer to reflect the heap object case). field_representation = MachineRepresentation::kTaggedPointer; Handle<FieldType> descriptors_field_type( transition_map->instance_descriptors()->GetFieldType(number), isolate()); if (descriptors_field_type->IsNone()) { // Store is not safe if the field type was cleared. return false; } else if (descriptors_field_type->IsClass()) { // Add proper code dependencies in case of stable field map(s). Handle<Map> field_owner_map(transition_map->FindFieldOwner(number), isolate()); dependencies()->AssumeFieldOwner(field_owner_map); // Remember the field map, and try to infer a useful type. field_type = Type::For(descriptors_field_type->AsClass()); field_map = descriptors_field_type->AsClass(); } } dependencies()->AssumeMapNotDeprecated(transition_map); // Transitioning stores are never stores to constant fields. *access_info = PropertyAccessInfo::DataField( kMutable, MapList{map}, field_index, field_representation, field_type, field_map, holder, transition_map); return true; } return false; } Factory* AccessInfoFactory::factory() const { return isolate()->factory(); } } // namespace compiler } // namespace internal } // namespace v8