1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "src/objects.h"
6
7 #include "src/bootstrapper.h"
8 #include "src/disasm.h"
9 #include "src/disassembler.h"
10 #include "src/macro-assembler.h"
11 #include "src/ostreams.h"
12 #include "src/regexp/jsregexp.h"
13
14 namespace v8 {
15 namespace internal {
16
17 #ifdef VERIFY_HEAP
18
ObjectVerify()19 void Object::ObjectVerify() {
20 if (IsSmi()) {
21 Smi::cast(this)->SmiVerify();
22 } else {
23 HeapObject::cast(this)->HeapObjectVerify();
24 }
25 CHECK(!IsConstructor() || IsCallable());
26 }
27
28
VerifyPointer(Object * p)29 void Object::VerifyPointer(Object* p) {
30 if (p->IsHeapObject()) {
31 HeapObject::VerifyHeapPointer(p);
32 } else {
33 CHECK(p->IsSmi());
34 }
35 }
36
37
SmiVerify()38 void Smi::SmiVerify() {
39 CHECK(IsSmi());
40 CHECK(!IsCallable());
41 CHECK(!IsConstructor());
42 }
43
44
HeapObjectVerify()45 void HeapObject::HeapObjectVerify() {
46 InstanceType instance_type = map()->instance_type();
47
48 if (instance_type < FIRST_NONSTRING_TYPE) {
49 String::cast(this)->StringVerify();
50 return;
51 }
52
53 switch (instance_type) {
54 case SYMBOL_TYPE:
55 Symbol::cast(this)->SymbolVerify();
56 break;
57 case MAP_TYPE:
58 Map::cast(this)->MapVerify();
59 break;
60 case HEAP_NUMBER_TYPE:
61 case MUTABLE_HEAP_NUMBER_TYPE:
62 HeapNumber::cast(this)->HeapNumberVerify();
63 break;
64 case SIMD128_VALUE_TYPE:
65 Simd128Value::cast(this)->Simd128ValueVerify();
66 break;
67 case FIXED_ARRAY_TYPE:
68 FixedArray::cast(this)->FixedArrayVerify();
69 break;
70 case FIXED_DOUBLE_ARRAY_TYPE:
71 FixedDoubleArray::cast(this)->FixedDoubleArrayVerify();
72 break;
73 case BYTE_ARRAY_TYPE:
74 ByteArray::cast(this)->ByteArrayVerify();
75 break;
76 case BYTECODE_ARRAY_TYPE:
77 BytecodeArray::cast(this)->BytecodeArrayVerify();
78 break;
79 case TRANSITION_ARRAY_TYPE:
80 TransitionArray::cast(this)->TransitionArrayVerify();
81 break;
82 case FREE_SPACE_TYPE:
83 FreeSpace::cast(this)->FreeSpaceVerify();
84 break;
85
86 #define VERIFY_TYPED_ARRAY(Type, type, TYPE, ctype, size) \
87 case FIXED_##TYPE##_ARRAY_TYPE: \
88 Fixed##Type##Array::cast(this)->FixedTypedArrayVerify(); \
89 break;
90
91 TYPED_ARRAYS(VERIFY_TYPED_ARRAY)
92 #undef VERIFY_TYPED_ARRAY
93
94 case CODE_TYPE:
95 Code::cast(this)->CodeVerify();
96 break;
97 case ODDBALL_TYPE:
98 Oddball::cast(this)->OddballVerify();
99 break;
100 case JS_OBJECT_TYPE:
101 case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
102 case JS_PROMISE_TYPE:
103 JSObject::cast(this)->JSObjectVerify();
104 break;
105 case JS_GENERATOR_OBJECT_TYPE:
106 JSGeneratorObject::cast(this)->JSGeneratorObjectVerify();
107 break;
108 case JS_MODULE_TYPE:
109 JSModule::cast(this)->JSModuleVerify();
110 break;
111 case JS_VALUE_TYPE:
112 JSValue::cast(this)->JSValueVerify();
113 break;
114 case JS_DATE_TYPE:
115 JSDate::cast(this)->JSDateVerify();
116 break;
117 case JS_BOUND_FUNCTION_TYPE:
118 JSBoundFunction::cast(this)->JSBoundFunctionVerify();
119 break;
120 case JS_FUNCTION_TYPE:
121 JSFunction::cast(this)->JSFunctionVerify();
122 break;
123 case JS_GLOBAL_PROXY_TYPE:
124 JSGlobalProxy::cast(this)->JSGlobalProxyVerify();
125 break;
126 case JS_GLOBAL_OBJECT_TYPE:
127 JSGlobalObject::cast(this)->JSGlobalObjectVerify();
128 break;
129 case CELL_TYPE:
130 Cell::cast(this)->CellVerify();
131 break;
132 case PROPERTY_CELL_TYPE:
133 PropertyCell::cast(this)->PropertyCellVerify();
134 break;
135 case WEAK_CELL_TYPE:
136 WeakCell::cast(this)->WeakCellVerify();
137 break;
138 case JS_ARRAY_TYPE:
139 JSArray::cast(this)->JSArrayVerify();
140 break;
141 case JS_SET_TYPE:
142 JSSet::cast(this)->JSSetVerify();
143 break;
144 case JS_MAP_TYPE:
145 JSMap::cast(this)->JSMapVerify();
146 break;
147 case JS_SET_ITERATOR_TYPE:
148 JSSetIterator::cast(this)->JSSetIteratorVerify();
149 break;
150 case JS_MAP_ITERATOR_TYPE:
151 JSMapIterator::cast(this)->JSMapIteratorVerify();
152 break;
153 case JS_ITERATOR_RESULT_TYPE:
154 JSIteratorResult::cast(this)->JSIteratorResultVerify();
155 break;
156 case JS_WEAK_MAP_TYPE:
157 JSWeakMap::cast(this)->JSWeakMapVerify();
158 break;
159 case JS_WEAK_SET_TYPE:
160 JSWeakSet::cast(this)->JSWeakSetVerify();
161 break;
162 case JS_REGEXP_TYPE:
163 JSRegExp::cast(this)->JSRegExpVerify();
164 break;
165 case FILLER_TYPE:
166 break;
167 case JS_PROXY_TYPE:
168 JSProxy::cast(this)->JSProxyVerify();
169 break;
170 case FOREIGN_TYPE:
171 Foreign::cast(this)->ForeignVerify();
172 break;
173 case SHARED_FUNCTION_INFO_TYPE:
174 SharedFunctionInfo::cast(this)->SharedFunctionInfoVerify();
175 break;
176 case JS_MESSAGE_OBJECT_TYPE:
177 JSMessageObject::cast(this)->JSMessageObjectVerify();
178 break;
179 case JS_ARRAY_BUFFER_TYPE:
180 JSArrayBuffer::cast(this)->JSArrayBufferVerify();
181 break;
182 case JS_TYPED_ARRAY_TYPE:
183 JSTypedArray::cast(this)->JSTypedArrayVerify();
184 break;
185 case JS_DATA_VIEW_TYPE:
186 JSDataView::cast(this)->JSDataViewVerify();
187 break;
188
189 #define MAKE_STRUCT_CASE(NAME, Name, name) \
190 case NAME##_TYPE: \
191 Name::cast(this)->Name##Verify(); \
192 break;
193 STRUCT_LIST(MAKE_STRUCT_CASE)
194 #undef MAKE_STRUCT_CASE
195
196 default:
197 UNREACHABLE();
198 break;
199 }
200 }
201
202
VerifyHeapPointer(Object * p)203 void HeapObject::VerifyHeapPointer(Object* p) {
204 CHECK(p->IsHeapObject());
205 HeapObject* ho = HeapObject::cast(p);
206 CHECK(ho->GetHeap()->Contains(ho));
207 }
208
209
SymbolVerify()210 void Symbol::SymbolVerify() {
211 CHECK(IsSymbol());
212 CHECK(HasHashCode());
213 CHECK_GT(Hash(), 0u);
214 CHECK(name()->IsUndefined() || name()->IsString());
215 }
216
217
HeapNumberVerify()218 void HeapNumber::HeapNumberVerify() {
219 CHECK(IsHeapNumber() || IsMutableHeapNumber());
220 }
221
222
Simd128ValueVerify()223 void Simd128Value::Simd128ValueVerify() { CHECK(IsSimd128Value()); }
224
225
ByteArrayVerify()226 void ByteArray::ByteArrayVerify() {
227 CHECK(IsByteArray());
228 }
229
230
BytecodeArrayVerify()231 void BytecodeArray::BytecodeArrayVerify() {
232 // TODO(oth): Walk bytecodes and immediate values to validate sanity.
233 CHECK(IsBytecodeArray());
234 CHECK(constant_pool()->IsFixedArray());
235 VerifyHeapPointer(constant_pool());
236 }
237
238
FreeSpaceVerify()239 void FreeSpace::FreeSpaceVerify() {
240 CHECK(IsFreeSpace());
241 }
242
243
244 template <class Traits>
FixedTypedArrayVerify()245 void FixedTypedArray<Traits>::FixedTypedArrayVerify() {
246 CHECK(IsHeapObject() &&
247 HeapObject::cast(this)->map()->instance_type() ==
248 Traits::kInstanceType);
249 if (base_pointer() == this) {
250 CHECK(external_pointer() ==
251 ExternalReference::fixed_typed_array_base_data_offset().address());
252 } else {
253 CHECK(base_pointer() == nullptr);
254 }
255 }
256
257
ElementsAreSafeToExamine()258 bool JSObject::ElementsAreSafeToExamine() {
259 // If a GC was caused while constructing this object, the elements
260 // pointer may point to a one pointer filler map.
261 return reinterpret_cast<Map*>(elements()) !=
262 GetHeap()->one_pointer_filler_map();
263 }
264
265
JSObjectVerify()266 void JSObject::JSObjectVerify() {
267 VerifyHeapPointer(properties());
268 VerifyHeapPointer(elements());
269
270 if (HasSloppyArgumentsElements()) {
271 CHECK(this->elements()->IsFixedArray());
272 CHECK_GE(this->elements()->length(), 2);
273 }
274
275 if (HasFastProperties()) {
276 int actual_unused_property_fields = map()->GetInObjectProperties() +
277 properties()->length() -
278 map()->NextFreePropertyIndex();
279 if (map()->unused_property_fields() != actual_unused_property_fields) {
280 // This could actually happen in the middle of StoreTransitionStub
281 // when the new extended backing store is already set into the object and
282 // the allocation of the MutableHeapNumber triggers GC (in this case map
283 // is not updated yet).
284 CHECK_EQ(map()->unused_property_fields(),
285 actual_unused_property_fields - JSObject::kFieldsAdded);
286 }
287 DescriptorArray* descriptors = map()->instance_descriptors();
288 for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
289 if (descriptors->GetDetails(i).type() == DATA) {
290 Representation r = descriptors->GetDetails(i).representation();
291 FieldIndex index = FieldIndex::ForDescriptor(map(), i);
292 if (IsUnboxedDoubleField(index)) {
293 DCHECK(r.IsDouble());
294 continue;
295 }
296 Object* value = RawFastPropertyAt(index);
297 if (r.IsDouble()) DCHECK(value->IsMutableHeapNumber());
298 if (value->IsUninitialized()) continue;
299 if (r.IsSmi()) DCHECK(value->IsSmi());
300 if (r.IsHeapObject()) DCHECK(value->IsHeapObject());
301 HeapType* field_type = descriptors->GetFieldType(i);
302 bool type_is_none = field_type->Is(HeapType::None());
303 bool type_is_any = HeapType::Any()->Is(field_type);
304 if (r.IsNone()) {
305 CHECK(type_is_none);
306 } else if (!type_is_any && !(type_is_none && r.IsHeapObject())) {
307 // If allocation folding is off then GC could happen during inner
308 // object literal creation and we will end up having and undefined
309 // value that does not match the field type.
310 CHECK(!field_type->NowStable() || field_type->NowContains(value) ||
311 (!FLAG_use_allocation_folding && value->IsUndefined()));
312 }
313 }
314 }
315 }
316
317 // If a GC was caused while constructing this object, the elements
318 // pointer may point to a one pointer filler map.
319 if (ElementsAreSafeToExamine()) {
320 CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
321 (elements() == GetHeap()->empty_fixed_array())),
322 (elements()->map() == GetHeap()->fixed_array_map() ||
323 elements()->map() == GetHeap()->fixed_cow_array_map()));
324 CHECK(map()->has_fast_object_elements() == HasFastObjectElements());
325 }
326 }
327
328
MapVerify()329 void Map::MapVerify() {
330 Heap* heap = GetHeap();
331 CHECK(!heap->InNewSpace(this));
332 CHECK(FIRST_TYPE <= instance_type() && instance_type() <= LAST_TYPE);
333 CHECK(instance_size() == kVariableSizeSentinel ||
334 (kPointerSize <= instance_size() &&
335 instance_size() < heap->Capacity()));
336 CHECK(GetBackPointer()->IsUndefined() ||
337 !Map::cast(GetBackPointer())->is_stable());
338 VerifyHeapPointer(prototype());
339 VerifyHeapPointer(instance_descriptors());
340 SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates());
341 SLOW_DCHECK(TransitionArray::IsSortedNoDuplicates(this));
342 SLOW_DCHECK(TransitionArray::IsConsistentWithBackPointers(this));
343 // TODO(ishell): turn it back to SLOW_DCHECK.
344 CHECK(!FLAG_unbox_double_fields ||
345 layout_descriptor()->IsConsistentWithMap(this));
346 }
347
348
DictionaryMapVerify()349 void Map::DictionaryMapVerify() {
350 MapVerify();
351 CHECK(is_dictionary_map());
352 CHECK(instance_descriptors()->IsEmpty());
353 CHECK_EQ(0, unused_property_fields());
354 CHECK_EQ(Heap::GetStaticVisitorIdForMap(this), visitor_id());
355 }
356
357
VerifyOmittedMapChecks()358 void Map::VerifyOmittedMapChecks() {
359 if (!FLAG_omit_map_checks_for_leaf_maps) return;
360 if (!is_stable() ||
361 is_deprecated() ||
362 is_dictionary_map()) {
363 CHECK(dependent_code()->IsEmpty(DependentCode::kPrototypeCheckGroup));
364 }
365 }
366
367
CodeCacheVerify()368 void CodeCache::CodeCacheVerify() {
369 VerifyHeapPointer(default_cache());
370 VerifyHeapPointer(normal_type_cache());
371 CHECK(default_cache()->IsFixedArray());
372 CHECK(normal_type_cache()->IsUndefined()
373 || normal_type_cache()->IsCodeCacheHashTable());
374 }
375
376
PolymorphicCodeCacheVerify()377 void PolymorphicCodeCache::PolymorphicCodeCacheVerify() {
378 VerifyHeapPointer(cache());
379 CHECK(cache()->IsUndefined() || cache()->IsPolymorphicCodeCacheHashTable());
380 }
381
382
TypeFeedbackInfoVerify()383 void TypeFeedbackInfo::TypeFeedbackInfoVerify() {
384 VerifyObjectField(kStorage1Offset);
385 VerifyObjectField(kStorage2Offset);
386 VerifyObjectField(kStorage3Offset);
387 }
388
389
AliasedArgumentsEntryVerify()390 void AliasedArgumentsEntry::AliasedArgumentsEntryVerify() {
391 VerifySmiField(kAliasedContextSlot);
392 }
393
394
FixedArrayVerify()395 void FixedArray::FixedArrayVerify() {
396 for (int i = 0; i < length(); i++) {
397 Object* e = get(i);
398 VerifyPointer(e);
399 }
400 }
401
402
FixedDoubleArrayVerify()403 void FixedDoubleArray::FixedDoubleArrayVerify() {
404 for (int i = 0; i < length(); i++) {
405 if (!is_the_hole(i)) {
406 uint64_t value = get_representation(i);
407 uint64_t unexpected =
408 bit_cast<uint64_t>(std::numeric_limits<double>::quiet_NaN()) &
409 V8_UINT64_C(0x7FF8000000000000);
410 // Create implementation specific sNaN by inverting relevant bit.
411 unexpected ^= V8_UINT64_C(0x0008000000000000);
412 CHECK((value & V8_UINT64_C(0x7FF8000000000000)) != unexpected ||
413 (value & V8_UINT64_C(0x0007FFFFFFFFFFFF)) == V8_UINT64_C(0));
414 }
415 }
416 }
417
418
TransitionArrayVerify()419 void TransitionArray::TransitionArrayVerify() {
420 for (int i = 0; i < length(); i++) {
421 Object* e = get(i);
422 VerifyPointer(e);
423 }
424 CHECK_LE(LengthFor(number_of_transitions()), length());
425 CHECK(next_link()->IsUndefined() || next_link()->IsSmi() ||
426 next_link()->IsTransitionArray());
427 }
428
429
JSGeneratorObjectVerify()430 void JSGeneratorObject::JSGeneratorObjectVerify() {
431 // In an expression like "new g()", there can be a point where a generator
432 // object is allocated but its fields are all undefined, as it hasn't yet been
433 // initialized by the generator. Hence these weak checks.
434 VerifyObjectField(kFunctionOffset);
435 VerifyObjectField(kContextOffset);
436 VerifyObjectField(kReceiverOffset);
437 VerifyObjectField(kOperandStackOffset);
438 VerifyObjectField(kContinuationOffset);
439 }
440
441
JSModuleVerify()442 void JSModule::JSModuleVerify() {
443 VerifyObjectField(kContextOffset);
444 VerifyObjectField(kScopeInfoOffset);
445 CHECK(context()->IsUndefined() ||
446 Context::cast(context())->IsModuleContext());
447 }
448
449
JSValueVerify()450 void JSValue::JSValueVerify() {
451 Object* v = value();
452 if (v->IsHeapObject()) {
453 VerifyHeapPointer(v);
454 }
455 }
456
457
JSDateVerify()458 void JSDate::JSDateVerify() {
459 if (value()->IsHeapObject()) {
460 VerifyHeapPointer(value());
461 }
462 CHECK(value()->IsUndefined() || value()->IsSmi() || value()->IsHeapNumber());
463 CHECK(year()->IsUndefined() || year()->IsSmi() || year()->IsNaN());
464 CHECK(month()->IsUndefined() || month()->IsSmi() || month()->IsNaN());
465 CHECK(day()->IsUndefined() || day()->IsSmi() || day()->IsNaN());
466 CHECK(weekday()->IsUndefined() || weekday()->IsSmi() || weekday()->IsNaN());
467 CHECK(hour()->IsUndefined() || hour()->IsSmi() || hour()->IsNaN());
468 CHECK(min()->IsUndefined() || min()->IsSmi() || min()->IsNaN());
469 CHECK(sec()->IsUndefined() || sec()->IsSmi() || sec()->IsNaN());
470 CHECK(cache_stamp()->IsUndefined() ||
471 cache_stamp()->IsSmi() ||
472 cache_stamp()->IsNaN());
473
474 if (month()->IsSmi()) {
475 int month = Smi::cast(this->month())->value();
476 CHECK(0 <= month && month <= 11);
477 }
478 if (day()->IsSmi()) {
479 int day = Smi::cast(this->day())->value();
480 CHECK(1 <= day && day <= 31);
481 }
482 if (hour()->IsSmi()) {
483 int hour = Smi::cast(this->hour())->value();
484 CHECK(0 <= hour && hour <= 23);
485 }
486 if (min()->IsSmi()) {
487 int min = Smi::cast(this->min())->value();
488 CHECK(0 <= min && min <= 59);
489 }
490 if (sec()->IsSmi()) {
491 int sec = Smi::cast(this->sec())->value();
492 CHECK(0 <= sec && sec <= 59);
493 }
494 if (weekday()->IsSmi()) {
495 int weekday = Smi::cast(this->weekday())->value();
496 CHECK(0 <= weekday && weekday <= 6);
497 }
498 if (cache_stamp()->IsSmi()) {
499 CHECK(Smi::cast(cache_stamp())->value() <=
500 Smi::cast(GetIsolate()->date_cache()->stamp())->value());
501 }
502 }
503
504
JSMessageObjectVerify()505 void JSMessageObject::JSMessageObjectVerify() {
506 CHECK(IsJSMessageObject());
507 VerifyObjectField(kStartPositionOffset);
508 VerifyObjectField(kEndPositionOffset);
509 VerifyObjectField(kArgumentsOffset);
510 VerifyObjectField(kScriptOffset);
511 VerifyObjectField(kStackFramesOffset);
512 }
513
514
StringVerify()515 void String::StringVerify() {
516 CHECK(IsString());
517 CHECK(length() >= 0 && length() <= Smi::kMaxValue);
518 if (IsInternalizedString()) {
519 CHECK(!GetHeap()->InNewSpace(this));
520 }
521 if (IsConsString()) {
522 ConsString::cast(this)->ConsStringVerify();
523 } else if (IsSlicedString()) {
524 SlicedString::cast(this)->SlicedStringVerify();
525 }
526 }
527
528
ConsStringVerify()529 void ConsString::ConsStringVerify() {
530 CHECK(this->first()->IsString());
531 CHECK(this->second() == GetHeap()->empty_string() ||
532 this->second()->IsString());
533 CHECK(this->length() >= ConsString::kMinLength);
534 CHECK(this->length() == this->first()->length() + this->second()->length());
535 if (this->IsFlat()) {
536 // A flat cons can only be created by String::SlowTryFlatten.
537 // Afterwards, the first part may be externalized.
538 CHECK(this->first()->IsSeqString() || this->first()->IsExternalString());
539 }
540 }
541
542
SlicedStringVerify()543 void SlicedString::SlicedStringVerify() {
544 CHECK(!this->parent()->IsConsString());
545 CHECK(!this->parent()->IsSlicedString());
546 CHECK(this->length() >= SlicedString::kMinLength);
547 }
548
549
JSBoundFunctionVerify()550 void JSBoundFunction::JSBoundFunctionVerify() {
551 CHECK(IsJSBoundFunction());
552 JSObjectVerify();
553 VerifyObjectField(kBoundThisOffset);
554 VerifyObjectField(kBoundTargetFunctionOffset);
555 VerifyObjectField(kBoundArgumentsOffset);
556 VerifyObjectField(kCreationContextOffset);
557 CHECK(bound_target_function()->IsCallable());
558 CHECK(creation_context()->IsNativeContext());
559 CHECK(IsCallable());
560 CHECK_EQ(IsConstructor(), bound_target_function()->IsConstructor());
561 }
562
563
JSFunctionVerify()564 void JSFunction::JSFunctionVerify() {
565 CHECK(IsJSFunction());
566 VerifyObjectField(kPrototypeOrInitialMapOffset);
567 VerifyObjectField(kNextFunctionLinkOffset);
568 CHECK(code()->IsCode());
569 CHECK(next_function_link() == NULL ||
570 next_function_link()->IsUndefined() ||
571 next_function_link()->IsJSFunction());
572 CHECK(map()->is_callable());
573 }
574
575
SharedFunctionInfoVerify()576 void SharedFunctionInfo::SharedFunctionInfoVerify() {
577 CHECK(IsSharedFunctionInfo());
578 VerifyObjectField(kNameOffset);
579 VerifyObjectField(kCodeOffset);
580 VerifyObjectField(kOptimizedCodeMapOffset);
581 VerifyObjectField(kFeedbackVectorOffset);
582 VerifyObjectField(kScopeInfoOffset);
583 VerifyObjectField(kInstanceClassNameOffset);
584 CHECK(function_data()->IsUndefined() || IsApiFunction() ||
585 HasBuiltinFunctionId() || HasBytecodeArray());
586 VerifyObjectField(kFunctionDataOffset);
587 VerifyObjectField(kScriptOffset);
588 VerifyObjectField(kDebugInfoOffset);
589 }
590
591
JSGlobalProxyVerify()592 void JSGlobalProxy::JSGlobalProxyVerify() {
593 CHECK(IsJSGlobalProxy());
594 JSObjectVerify();
595 VerifyObjectField(JSGlobalProxy::kNativeContextOffset);
596 // Make sure that this object has no properties, elements.
597 CHECK_EQ(0, properties()->length());
598 CHECK_EQ(0, FixedArray::cast(elements())->length());
599 }
600
601
JSGlobalObjectVerify()602 void JSGlobalObject::JSGlobalObjectVerify() {
603 CHECK(IsJSGlobalObject());
604 // Do not check the dummy global object for the builtins.
605 if (GlobalDictionary::cast(properties())->NumberOfElements() == 0 &&
606 elements()->length() == 0) {
607 return;
608 }
609 JSObjectVerify();
610 }
611
612
OddballVerify()613 void Oddball::OddballVerify() {
614 CHECK(IsOddball());
615 Heap* heap = GetHeap();
616 VerifyHeapPointer(to_string());
617 Object* number = to_number();
618 if (number->IsHeapObject()) {
619 CHECK(number == heap->nan_value());
620 } else {
621 CHECK(number->IsSmi());
622 int value = Smi::cast(number)->value();
623 // Hidden oddballs have negative smis.
624 const int kLeastHiddenOddballNumber = -5;
625 CHECK_LE(value, 1);
626 CHECK(value >= kLeastHiddenOddballNumber);
627 }
628 if (map() == heap->undefined_map()) {
629 CHECK(this == heap->undefined_value());
630 } else if (map() == heap->the_hole_map()) {
631 CHECK(this == heap->the_hole_value());
632 } else if (map() == heap->null_map()) {
633 CHECK(this == heap->null_value());
634 } else if (map() == heap->boolean_map()) {
635 CHECK(this == heap->true_value() ||
636 this == heap->false_value());
637 } else if (map() == heap->uninitialized_map()) {
638 CHECK(this == heap->uninitialized_value());
639 } else if (map() == heap->no_interceptor_result_sentinel_map()) {
640 CHECK(this == heap->no_interceptor_result_sentinel());
641 } else if (map() == heap->arguments_marker_map()) {
642 CHECK(this == heap->arguments_marker());
643 } else if (map() == heap->termination_exception_map()) {
644 CHECK(this == heap->termination_exception());
645 } else if (map() == heap->exception_map()) {
646 CHECK(this == heap->exception());
647 } else {
648 UNREACHABLE();
649 }
650 }
651
652
CellVerify()653 void Cell::CellVerify() {
654 CHECK(IsCell());
655 VerifyObjectField(kValueOffset);
656 }
657
658
PropertyCellVerify()659 void PropertyCell::PropertyCellVerify() {
660 CHECK(IsPropertyCell());
661 VerifyObjectField(kValueOffset);
662 }
663
664
WeakCellVerify()665 void WeakCell::WeakCellVerify() {
666 CHECK(IsWeakCell());
667 VerifyObjectField(kValueOffset);
668 VerifyObjectField(kNextOffset);
669 }
670
671
CodeVerify()672 void Code::CodeVerify() {
673 CHECK(IsAligned(reinterpret_cast<intptr_t>(instruction_start()),
674 kCodeAlignment));
675 relocation_info()->ObjectVerify();
676 Address last_gc_pc = NULL;
677 Isolate* isolate = GetIsolate();
678 for (RelocIterator it(this); !it.done(); it.next()) {
679 it.rinfo()->Verify(isolate);
680 // Ensure that GC will not iterate twice over the same pointer.
681 if (RelocInfo::IsGCRelocMode(it.rinfo()->rmode())) {
682 CHECK(it.rinfo()->pc() != last_gc_pc);
683 last_gc_pc = it.rinfo()->pc();
684 }
685 }
686 CHECK(raw_type_feedback_info() == Smi::FromInt(0) ||
687 raw_type_feedback_info()->IsSmi() == IsCodeStubOrIC());
688 }
689
690
VerifyEmbeddedObjectsDependency()691 void Code::VerifyEmbeddedObjectsDependency() {
692 if (!CanContainWeakObjects()) return;
693 WeakCell* cell = CachedWeakCell();
694 DisallowHeapAllocation no_gc;
695 Isolate* isolate = GetIsolate();
696 HandleScope scope(isolate);
697 int mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
698 for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
699 Object* obj = it.rinfo()->target_object();
700 if (IsWeakObject(obj)) {
701 if (obj->IsMap()) {
702 Map* map = Map::cast(obj);
703 CHECK(map->dependent_code()->Contains(DependentCode::kWeakCodeGroup,
704 cell));
705 } else if (obj->IsJSObject()) {
706 WeakHashTable* table =
707 GetIsolate()->heap()->weak_object_to_code_table();
708 Handle<HeapObject> key_obj(HeapObject::cast(obj), isolate);
709 CHECK(DependentCode::cast(table->Lookup(key_obj))
710 ->Contains(DependentCode::kWeakCodeGroup, cell));
711 }
712 }
713 }
714 }
715
716
JSArrayVerify()717 void JSArray::JSArrayVerify() {
718 JSObjectVerify();
719 CHECK(length()->IsNumber() || length()->IsUndefined());
720 // If a GC was caused while constructing this array, the elements
721 // pointer may point to a one pointer filler map.
722 if (ElementsAreSafeToExamine()) {
723 CHECK(elements()->IsUndefined() ||
724 elements()->IsFixedArray() ||
725 elements()->IsFixedDoubleArray());
726 }
727 }
728
729
JSSetVerify()730 void JSSet::JSSetVerify() {
731 CHECK(IsJSSet());
732 JSObjectVerify();
733 VerifyHeapPointer(table());
734 CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
735 // TODO(arv): Verify OrderedHashTable too.
736 }
737
738
JSMapVerify()739 void JSMap::JSMapVerify() {
740 CHECK(IsJSMap());
741 JSObjectVerify();
742 VerifyHeapPointer(table());
743 CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
744 // TODO(arv): Verify OrderedHashTable too.
745 }
746
747
JSSetIteratorVerify()748 void JSSetIterator::JSSetIteratorVerify() {
749 CHECK(IsJSSetIterator());
750 JSObjectVerify();
751 VerifyHeapPointer(table());
752 CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
753 CHECK(index()->IsSmi() || index()->IsUndefined());
754 CHECK(kind()->IsSmi() || kind()->IsUndefined());
755 }
756
757
JSMapIteratorVerify()758 void JSMapIterator::JSMapIteratorVerify() {
759 CHECK(IsJSMapIterator());
760 JSObjectVerify();
761 VerifyHeapPointer(table());
762 CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
763 CHECK(index()->IsSmi() || index()->IsUndefined());
764 CHECK(kind()->IsSmi() || kind()->IsUndefined());
765 }
766
767
JSIteratorResultVerify()768 void JSIteratorResult::JSIteratorResultVerify() {
769 CHECK(IsJSIteratorResult());
770 JSObjectVerify();
771 VerifyPointer(done());
772 VerifyPointer(value());
773 }
774
775
JSWeakMapVerify()776 void JSWeakMap::JSWeakMapVerify() {
777 CHECK(IsJSWeakMap());
778 JSObjectVerify();
779 VerifyHeapPointer(table());
780 CHECK(table()->IsHashTable() || table()->IsUndefined());
781 }
782
783
JSWeakSetVerify()784 void JSWeakSet::JSWeakSetVerify() {
785 CHECK(IsJSWeakSet());
786 JSObjectVerify();
787 VerifyHeapPointer(table());
788 CHECK(table()->IsHashTable() || table()->IsUndefined());
789 }
790
791
JSRegExpVerify()792 void JSRegExp::JSRegExpVerify() {
793 JSObjectVerify();
794 CHECK(data()->IsUndefined() || data()->IsFixedArray());
795 switch (TypeTag()) {
796 case JSRegExp::ATOM: {
797 FixedArray* arr = FixedArray::cast(data());
798 CHECK(arr->get(JSRegExp::kAtomPatternIndex)->IsString());
799 break;
800 }
801 case JSRegExp::IRREGEXP: {
802 bool is_native = RegExpImpl::UsesNativeRegExp();
803
804 FixedArray* arr = FixedArray::cast(data());
805 Object* one_byte_data = arr->get(JSRegExp::kIrregexpLatin1CodeIndex);
806 // Smi : Not compiled yet (-1) or code prepared for flushing.
807 // JSObject: Compilation error.
808 // Code/ByteArray: Compiled code.
809 CHECK(
810 one_byte_data->IsSmi() ||
811 (is_native ? one_byte_data->IsCode() : one_byte_data->IsByteArray()));
812 Object* uc16_data = arr->get(JSRegExp::kIrregexpUC16CodeIndex);
813 CHECK(uc16_data->IsSmi() ||
814 (is_native ? uc16_data->IsCode() : uc16_data->IsByteArray()));
815
816 Object* one_byte_saved =
817 arr->get(JSRegExp::kIrregexpLatin1CodeSavedIndex);
818 CHECK(one_byte_saved->IsSmi() || one_byte_saved->IsString() ||
819 one_byte_saved->IsCode());
820 Object* uc16_saved = arr->get(JSRegExp::kIrregexpUC16CodeSavedIndex);
821 CHECK(uc16_saved->IsSmi() || uc16_saved->IsString() ||
822 uc16_saved->IsCode());
823
824 CHECK(arr->get(JSRegExp::kIrregexpCaptureCountIndex)->IsSmi());
825 CHECK(arr->get(JSRegExp::kIrregexpMaxRegisterCountIndex)->IsSmi());
826 break;
827 }
828 default:
829 CHECK_EQ(JSRegExp::NOT_COMPILED, TypeTag());
830 CHECK(data()->IsUndefined());
831 break;
832 }
833 }
834
835
JSProxyVerify()836 void JSProxy::JSProxyVerify() {
837 CHECK(IsJSProxy());
838 VerifyPointer(target());
839 VerifyPointer(handler());
840 CHECK_EQ(target()->IsCallable(), map()->is_callable());
841 CHECK_EQ(target()->IsConstructor(), map()->is_constructor());
842 CHECK(hash()->IsSmi() || hash()->IsUndefined());
843 CHECK(map()->prototype()->IsNull());
844 // There should be no properties on a Proxy.
845 CHECK_EQ(0, map()->NumberOfOwnDescriptors());
846 }
847
848
JSArrayBufferVerify()849 void JSArrayBuffer::JSArrayBufferVerify() {
850 CHECK(IsJSArrayBuffer());
851 JSObjectVerify();
852 VerifyPointer(byte_length());
853 CHECK(byte_length()->IsSmi() || byte_length()->IsHeapNumber()
854 || byte_length()->IsUndefined());
855 }
856
857
JSArrayBufferViewVerify()858 void JSArrayBufferView::JSArrayBufferViewVerify() {
859 CHECK(IsJSArrayBufferView());
860 JSObjectVerify();
861 VerifyPointer(buffer());
862 CHECK(buffer()->IsJSArrayBuffer() || buffer()->IsUndefined()
863 || buffer() == Smi::FromInt(0));
864
865 VerifyPointer(raw_byte_offset());
866 CHECK(raw_byte_offset()->IsSmi() || raw_byte_offset()->IsHeapNumber() ||
867 raw_byte_offset()->IsUndefined());
868
869 VerifyPointer(raw_byte_length());
870 CHECK(raw_byte_length()->IsSmi() || raw_byte_length()->IsHeapNumber() ||
871 raw_byte_length()->IsUndefined());
872 }
873
874
JSTypedArrayVerify()875 void JSTypedArray::JSTypedArrayVerify() {
876 CHECK(IsJSTypedArray());
877 JSArrayBufferViewVerify();
878 VerifyPointer(raw_length());
879 CHECK(raw_length()->IsSmi() || raw_length()->IsHeapNumber() ||
880 raw_length()->IsUndefined());
881
882 VerifyPointer(elements());
883 }
884
885
JSDataViewVerify()886 void JSDataView::JSDataViewVerify() {
887 CHECK(IsJSDataView());
888 JSArrayBufferViewVerify();
889 }
890
891
ForeignVerify()892 void Foreign::ForeignVerify() {
893 CHECK(IsForeign());
894 }
895
896
BoxVerify()897 void Box::BoxVerify() {
898 CHECK(IsBox());
899 value()->ObjectVerify();
900 }
901
902
PrototypeInfoVerify()903 void PrototypeInfo::PrototypeInfoVerify() {
904 CHECK(IsPrototypeInfo());
905 if (prototype_users()->IsWeakFixedArray()) {
906 WeakFixedArray::cast(prototype_users())->FixedArrayVerify();
907 } else {
908 CHECK(prototype_users()->IsSmi());
909 }
910 CHECK(validity_cell()->IsCell() || validity_cell()->IsSmi());
911 }
912
913
AccessorInfoVerify()914 void AccessorInfo::AccessorInfoVerify() {
915 VerifyPointer(name());
916 VerifyPointer(expected_receiver_type());
917 }
918
919
920 void SloppyBlockWithEvalContextExtension::
SloppyBlockWithEvalContextExtensionVerify()921 SloppyBlockWithEvalContextExtensionVerify() {
922 CHECK(IsSloppyBlockWithEvalContextExtension());
923 VerifyObjectField(kScopeInfoOffset);
924 VerifyObjectField(kExtensionOffset);
925 }
926
927
ExecutableAccessorInfoVerify()928 void ExecutableAccessorInfo::ExecutableAccessorInfoVerify() {
929 CHECK(IsExecutableAccessorInfo());
930 AccessorInfoVerify();
931 VerifyPointer(getter());
932 VerifyPointer(setter());
933 VerifyPointer(data());
934 }
935
936
AccessorPairVerify()937 void AccessorPair::AccessorPairVerify() {
938 CHECK(IsAccessorPair());
939 VerifyPointer(getter());
940 VerifyPointer(setter());
941 }
942
943
AccessCheckInfoVerify()944 void AccessCheckInfo::AccessCheckInfoVerify() {
945 CHECK(IsAccessCheckInfo());
946 VerifyPointer(named_callback());
947 VerifyPointer(indexed_callback());
948 VerifyPointer(callback());
949 VerifyPointer(data());
950 }
951
952
InterceptorInfoVerify()953 void InterceptorInfo::InterceptorInfoVerify() {
954 CHECK(IsInterceptorInfo());
955 VerifyPointer(getter());
956 VerifyPointer(setter());
957 VerifyPointer(query());
958 VerifyPointer(deleter());
959 VerifyPointer(enumerator());
960 VerifyPointer(data());
961 VerifySmiField(kFlagsOffset);
962 }
963
964
CallHandlerInfoVerify()965 void CallHandlerInfo::CallHandlerInfoVerify() {
966 CHECK(IsCallHandlerInfo());
967 VerifyPointer(callback());
968 VerifyPointer(data());
969 }
970
971
TemplateInfoVerify()972 void TemplateInfo::TemplateInfoVerify() {
973 VerifyPointer(tag());
974 VerifyPointer(property_list());
975 VerifyPointer(property_accessors());
976 }
977
978
FunctionTemplateInfoVerify()979 void FunctionTemplateInfo::FunctionTemplateInfoVerify() {
980 CHECK(IsFunctionTemplateInfo());
981 TemplateInfoVerify();
982 VerifyPointer(serial_number());
983 VerifyPointer(call_code());
984 VerifyPointer(prototype_template());
985 VerifyPointer(parent_template());
986 VerifyPointer(named_property_handler());
987 VerifyPointer(indexed_property_handler());
988 VerifyPointer(instance_template());
989 VerifyPointer(signature());
990 VerifyPointer(access_check_info());
991 }
992
993
ObjectTemplateInfoVerify()994 void ObjectTemplateInfo::ObjectTemplateInfoVerify() {
995 CHECK(IsObjectTemplateInfo());
996 TemplateInfoVerify();
997 VerifyPointer(constructor());
998 VerifyPointer(internal_field_count());
999 }
1000
1001
AllocationSiteVerify()1002 void AllocationSite::AllocationSiteVerify() {
1003 CHECK(IsAllocationSite());
1004 }
1005
1006
AllocationMementoVerify()1007 void AllocationMemento::AllocationMementoVerify() {
1008 CHECK(IsAllocationMemento());
1009 VerifyHeapPointer(allocation_site());
1010 CHECK(!IsValid() || GetAllocationSite()->IsAllocationSite());
1011 }
1012
1013
ScriptVerify()1014 void Script::ScriptVerify() {
1015 CHECK(IsScript());
1016 VerifyPointer(source());
1017 VerifyPointer(name());
1018 VerifyPointer(wrapper());
1019 VerifyPointer(line_ends());
1020 }
1021
1022
NormalizedMapCacheVerify()1023 void NormalizedMapCache::NormalizedMapCacheVerify() {
1024 FixedArray::cast(this)->FixedArrayVerify();
1025 if (FLAG_enable_slow_asserts) {
1026 for (int i = 0; i < length(); i++) {
1027 Object* e = FixedArray::get(i);
1028 if (e->IsMap()) {
1029 Map::cast(e)->DictionaryMapVerify();
1030 } else {
1031 CHECK(e->IsUndefined());
1032 }
1033 }
1034 }
1035 }
1036
1037
DebugInfoVerify()1038 void DebugInfo::DebugInfoVerify() {
1039 CHECK(IsDebugInfo());
1040 VerifyPointer(shared());
1041 VerifyPointer(code());
1042 VerifyPointer(break_points());
1043 }
1044
1045
BreakPointInfoVerify()1046 void BreakPointInfo::BreakPointInfoVerify() {
1047 CHECK(IsBreakPointInfo());
1048 VerifyPointer(break_point_objects());
1049 }
1050 #endif // VERIFY_HEAP
1051
1052 #ifdef DEBUG
1053
IncrementSpillStatistics(SpillInformation * info)1054 void JSObject::IncrementSpillStatistics(SpillInformation* info) {
1055 info->number_of_objects_++;
1056 // Named properties
1057 if (HasFastProperties()) {
1058 info->number_of_objects_with_fast_properties_++;
1059 info->number_of_fast_used_fields_ += map()->NextFreePropertyIndex();
1060 info->number_of_fast_unused_fields_ += map()->unused_property_fields();
1061 } else if (IsJSGlobalObject()) {
1062 GlobalDictionary* dict = global_dictionary();
1063 info->number_of_slow_used_properties_ += dict->NumberOfElements();
1064 info->number_of_slow_unused_properties_ +=
1065 dict->Capacity() - dict->NumberOfElements();
1066 } else {
1067 NameDictionary* dict = property_dictionary();
1068 info->number_of_slow_used_properties_ += dict->NumberOfElements();
1069 info->number_of_slow_unused_properties_ +=
1070 dict->Capacity() - dict->NumberOfElements();
1071 }
1072 // Indexed properties
1073 switch (GetElementsKind()) {
1074 case FAST_HOLEY_SMI_ELEMENTS:
1075 case FAST_SMI_ELEMENTS:
1076 case FAST_HOLEY_DOUBLE_ELEMENTS:
1077 case FAST_DOUBLE_ELEMENTS:
1078 case FAST_HOLEY_ELEMENTS:
1079 case FAST_ELEMENTS: {
1080 info->number_of_objects_with_fast_elements_++;
1081 int holes = 0;
1082 FixedArray* e = FixedArray::cast(elements());
1083 int len = e->length();
1084 Heap* heap = GetHeap();
1085 for (int i = 0; i < len; i++) {
1086 if (e->get(i) == heap->the_hole_value()) holes++;
1087 }
1088 info->number_of_fast_used_elements_ += len - holes;
1089 info->number_of_fast_unused_elements_ += holes;
1090 break;
1091 }
1092
1093 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
1094 case TYPE##_ELEMENTS:
1095
1096 TYPED_ARRAYS(TYPED_ARRAY_CASE)
1097 #undef TYPED_ARRAY_CASE
1098 { info->number_of_objects_with_fast_elements_++;
1099 FixedArrayBase* e = FixedArrayBase::cast(elements());
1100 info->number_of_fast_used_elements_ += e->length();
1101 break;
1102 }
1103 case DICTIONARY_ELEMENTS: {
1104 SeededNumberDictionary* dict = element_dictionary();
1105 info->number_of_slow_used_elements_ += dict->NumberOfElements();
1106 info->number_of_slow_unused_elements_ +=
1107 dict->Capacity() - dict->NumberOfElements();
1108 break;
1109 }
1110 case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
1111 case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
1112 break;
1113 }
1114 }
1115
1116
Clear()1117 void JSObject::SpillInformation::Clear() {
1118 number_of_objects_ = 0;
1119 number_of_objects_with_fast_properties_ = 0;
1120 number_of_objects_with_fast_elements_ = 0;
1121 number_of_fast_used_fields_ = 0;
1122 number_of_fast_unused_fields_ = 0;
1123 number_of_slow_used_properties_ = 0;
1124 number_of_slow_unused_properties_ = 0;
1125 number_of_fast_used_elements_ = 0;
1126 number_of_fast_unused_elements_ = 0;
1127 number_of_slow_used_elements_ = 0;
1128 number_of_slow_unused_elements_ = 0;
1129 }
1130
1131
Print()1132 void JSObject::SpillInformation::Print() {
1133 PrintF("\n JSObject Spill Statistics (#%d):\n", number_of_objects_);
1134
1135 PrintF(" - fast properties (#%d): %d (used) %d (unused)\n",
1136 number_of_objects_with_fast_properties_,
1137 number_of_fast_used_fields_, number_of_fast_unused_fields_);
1138
1139 PrintF(" - slow properties (#%d): %d (used) %d (unused)\n",
1140 number_of_objects_ - number_of_objects_with_fast_properties_,
1141 number_of_slow_used_properties_, number_of_slow_unused_properties_);
1142
1143 PrintF(" - fast elements (#%d): %d (used) %d (unused)\n",
1144 number_of_objects_with_fast_elements_,
1145 number_of_fast_used_elements_, number_of_fast_unused_elements_);
1146
1147 PrintF(" - slow elements (#%d): %d (used) %d (unused)\n",
1148 number_of_objects_ - number_of_objects_with_fast_elements_,
1149 number_of_slow_used_elements_, number_of_slow_unused_elements_);
1150
1151 PrintF("\n");
1152 }
1153
1154
IsSortedNoDuplicates(int valid_entries)1155 bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
1156 if (valid_entries == -1) valid_entries = number_of_descriptors();
1157 Name* current_key = NULL;
1158 uint32_t current = 0;
1159 for (int i = 0; i < number_of_descriptors(); i++) {
1160 Name* key = GetSortedKey(i);
1161 if (key == current_key) {
1162 Print();
1163 return false;
1164 }
1165 current_key = key;
1166 uint32_t hash = GetSortedKey(i)->Hash();
1167 if (hash < current) {
1168 Print();
1169 return false;
1170 }
1171 current = hash;
1172 }
1173 return true;
1174 }
1175
1176
IsSortedNoDuplicates(int valid_entries)1177 bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
1178 DCHECK(valid_entries == -1);
1179 Name* prev_key = NULL;
1180 PropertyKind prev_kind = kData;
1181 PropertyAttributes prev_attributes = NONE;
1182 uint32_t prev_hash = 0;
1183 for (int i = 0; i < number_of_transitions(); i++) {
1184 Name* key = GetSortedKey(i);
1185 uint32_t hash = key->Hash();
1186 PropertyKind kind = kData;
1187 PropertyAttributes attributes = NONE;
1188 if (!IsSpecialTransition(key)) {
1189 Map* target = GetTarget(i);
1190 PropertyDetails details = GetTargetDetails(key, target);
1191 kind = details.kind();
1192 attributes = details.attributes();
1193 } else {
1194 // Duplicate entries are not allowed for non-property transitions.
1195 CHECK_NE(prev_key, key);
1196 }
1197
1198 int cmp = CompareKeys(prev_key, prev_hash, prev_kind, prev_attributes, key,
1199 hash, kind, attributes);
1200 if (cmp >= 0) {
1201 Print();
1202 return false;
1203 }
1204 prev_key = key;
1205 prev_hash = hash;
1206 prev_attributes = attributes;
1207 prev_kind = kind;
1208 }
1209 return true;
1210 }
1211
1212
1213 // static
IsSortedNoDuplicates(Map * map)1214 bool TransitionArray::IsSortedNoDuplicates(Map* map) {
1215 Object* raw_transitions = map->raw_transitions();
1216 if (IsFullTransitionArray(raw_transitions)) {
1217 return TransitionArray::cast(raw_transitions)->IsSortedNoDuplicates();
1218 }
1219 // Simple and non-existent transitions are always sorted.
1220 return true;
1221 }
1222
1223
CheckOneBackPointer(Map * current_map,Object * target)1224 static bool CheckOneBackPointer(Map* current_map, Object* target) {
1225 return !target->IsMap() || Map::cast(target)->GetBackPointer() == current_map;
1226 }
1227
1228
1229 // static
IsConsistentWithBackPointers(Map * map)1230 bool TransitionArray::IsConsistentWithBackPointers(Map* map) {
1231 Object* transitions = map->raw_transitions();
1232 for (int i = 0; i < TransitionArray::NumberOfTransitions(transitions); ++i) {
1233 Map* target = TransitionArray::GetTarget(transitions, i);
1234 if (!CheckOneBackPointer(map, target)) return false;
1235 }
1236 return true;
1237 }
1238
1239
1240 // Estimates if there is a path from the object to a context.
1241 // This function is not precise, and can return false even if
1242 // there is a path to a context.
CanLeak(Object * obj,Heap * heap,bool skip_weak_cell)1243 bool CanLeak(Object* obj, Heap* heap, bool skip_weak_cell) {
1244 if (!obj->IsHeapObject()) return false;
1245 if (obj->IsWeakCell()) {
1246 if (skip_weak_cell) return false;
1247 return CanLeak(WeakCell::cast(obj)->value(), heap, skip_weak_cell);
1248 }
1249 if (obj->IsCell()) {
1250 return CanLeak(Cell::cast(obj)->value(), heap, skip_weak_cell);
1251 }
1252 if (obj->IsPropertyCell()) {
1253 return CanLeak(PropertyCell::cast(obj)->value(), heap, skip_weak_cell);
1254 }
1255 if (obj->IsContext()) return true;
1256 if (obj->IsMap()) {
1257 Map* map = Map::cast(obj);
1258 for (int i = 0; i < Heap::kStrongRootListLength; i++) {
1259 Heap::RootListIndex root_index = static_cast<Heap::RootListIndex>(i);
1260 if (map == heap->root(root_index)) return false;
1261 }
1262 return true;
1263 }
1264 return CanLeak(HeapObject::cast(obj)->map(), heap, skip_weak_cell);
1265 }
1266
1267
VerifyEmbeddedObjects(VerifyMode mode)1268 void Code::VerifyEmbeddedObjects(VerifyMode mode) {
1269 if (kind() == OPTIMIZED_FUNCTION) return;
1270 Heap* heap = GetIsolate()->heap();
1271 int mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
1272 RelocInfo::ModeMask(RelocInfo::CELL);
1273 bool skip_weak_cell = (mode == kNoContextSpecificPointers) ? false : true;
1274 for (RelocIterator it(this, mask); !it.done(); it.next()) {
1275 Object* target = it.rinfo()->rmode() == RelocInfo::CELL
1276 ? it.rinfo()->target_cell()
1277 : it.rinfo()->target_object();
1278 CHECK(!CanLeak(target, heap, skip_weak_cell));
1279 }
1280 }
1281
1282
1283 // Verify that the debugger can redirect old code to the new code.
VerifyRecompiledCode(Code * old_code,Code * new_code)1284 void Code::VerifyRecompiledCode(Code* old_code, Code* new_code) {
1285 if (old_code->kind() != FUNCTION) return;
1286 if (new_code->kind() != FUNCTION) return;
1287 Isolate* isolate = old_code->GetIsolate();
1288 // Do not verify during bootstrapping. We may replace code using %SetCode.
1289 if (isolate->bootstrapper()->IsActive()) return;
1290
1291 static const int mask = RelocInfo::kCodeTargetMask;
1292 RelocIterator old_it(old_code, mask);
1293 RelocIterator new_it(new_code, mask);
1294 Code* stack_check = isolate->builtins()->builtin(Builtins::kStackCheck);
1295
1296 while (!old_it.done()) {
1297 RelocInfo* rinfo = old_it.rinfo();
1298 Code* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
1299 CHECK(!target->is_handler() && !target->is_inline_cache_stub());
1300 if (target == stack_check) break;
1301 old_it.next();
1302 }
1303
1304 while (!new_it.done()) {
1305 RelocInfo* rinfo = new_it.rinfo();
1306 Code* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
1307 CHECK(!target->is_handler() && !target->is_inline_cache_stub());
1308 if (target == stack_check) break;
1309 new_it.next();
1310 }
1311
1312 // Either both are done because there is no stack check.
1313 // Or we are past the prologue for both.
1314 CHECK_EQ(new_it.done(), old_it.done());
1315
1316 // After the prologue, each call in the old code has a corresponding call
1317 // in the new code.
1318 while (!old_it.done() && !new_it.done()) {
1319 Code* old_target =
1320 Code::GetCodeFromTargetAddress(old_it.rinfo()->target_address());
1321 Code* new_target =
1322 Code::GetCodeFromTargetAddress(new_it.rinfo()->target_address());
1323 CHECK_EQ(old_target->kind(), new_target->kind());
1324 // Check call target for equality unless it's an IC or an interrupt check.
1325 // In both cases they may be patched to be something else.
1326 if (!old_target->is_handler() && !old_target->is_inline_cache_stub() &&
1327 new_target != isolate->builtins()->builtin(Builtins::kInterruptCheck)) {
1328 CHECK_EQ(old_target, new_target);
1329 }
1330 old_it.next();
1331 new_it.next();
1332 }
1333
1334 // Both are done at the same time.
1335 CHECK_EQ(new_it.done(), old_it.done());
1336 }
1337
1338
1339 #endif // DEBUG
1340
1341 } // namespace internal
1342 } // namespace v8
1343