• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #include "src/v8.h"
6 
7 #include "src/disassembler.h"
8 #include "src/disasm.h"
9 #include "src/jsregexp.h"
10 #include "src/macro-assembler.h"
11 #include "src/objects-visiting.h"
12 
13 namespace v8 {
14 namespace internal {
15 
16 #ifdef VERIFY_HEAP
17 
ObjectVerify()18 void Object::ObjectVerify() {
19   if (IsSmi()) {
20     Smi::cast(this)->SmiVerify();
21   } else {
22     HeapObject::cast(this)->HeapObjectVerify();
23   }
24 }
25 
26 
VerifyPointer(Object * p)27 void Object::VerifyPointer(Object* p) {
28   if (p->IsHeapObject()) {
29     HeapObject::VerifyHeapPointer(p);
30   } else {
31     CHECK(p->IsSmi());
32   }
33 }
34 
35 
SmiVerify()36 void Smi::SmiVerify() {
37   CHECK(IsSmi());
38 }
39 
40 
HeapObjectVerify()41 void HeapObject::HeapObjectVerify() {
42   InstanceType instance_type = map()->instance_type();
43 
44   if (instance_type < FIRST_NONSTRING_TYPE) {
45     String::cast(this)->StringVerify();
46     return;
47   }
48 
49   switch (instance_type) {
50     case SYMBOL_TYPE:
51       Symbol::cast(this)->SymbolVerify();
52       break;
53     case MAP_TYPE:
54       Map::cast(this)->MapVerify();
55       break;
56     case HEAP_NUMBER_TYPE:
57       HeapNumber::cast(this)->HeapNumberVerify();
58       break;
59     case FIXED_ARRAY_TYPE:
60       FixedArray::cast(this)->FixedArrayVerify();
61       break;
62     case FIXED_DOUBLE_ARRAY_TYPE:
63       FixedDoubleArray::cast(this)->FixedDoubleArrayVerify();
64       break;
65     case CONSTANT_POOL_ARRAY_TYPE:
66       ConstantPoolArray::cast(this)->ConstantPoolArrayVerify();
67       break;
68     case BYTE_ARRAY_TYPE:
69       ByteArray::cast(this)->ByteArrayVerify();
70       break;
71     case FREE_SPACE_TYPE:
72       FreeSpace::cast(this)->FreeSpaceVerify();
73       break;
74 
75 #define VERIFY_TYPED_ARRAY(Type, type, TYPE, ctype, size)                      \
76     case EXTERNAL_##TYPE##_ARRAY_TYPE:                                         \
77       External##Type##Array::cast(this)->External##Type##ArrayVerify();        \
78       break;                                                                   \
79     case FIXED_##TYPE##_ARRAY_TYPE:                                            \
80       Fixed##Type##Array::cast(this)->FixedTypedArrayVerify();                 \
81       break;
82 
83     TYPED_ARRAYS(VERIFY_TYPED_ARRAY)
84 #undef VERIFY_TYPED_ARRAY
85 
86     case CODE_TYPE:
87       Code::cast(this)->CodeVerify();
88       break;
89     case ODDBALL_TYPE:
90       Oddball::cast(this)->OddballVerify();
91       break;
92     case JS_OBJECT_TYPE:
93     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
94       JSObject::cast(this)->JSObjectVerify();
95       break;
96     case JS_GENERATOR_OBJECT_TYPE:
97       JSGeneratorObject::cast(this)->JSGeneratorObjectVerify();
98       break;
99     case JS_MODULE_TYPE:
100       JSModule::cast(this)->JSModuleVerify();
101       break;
102     case JS_VALUE_TYPE:
103       JSValue::cast(this)->JSValueVerify();
104       break;
105     case JS_DATE_TYPE:
106       JSDate::cast(this)->JSDateVerify();
107       break;
108     case JS_FUNCTION_TYPE:
109       JSFunction::cast(this)->JSFunctionVerify();
110       break;
111     case JS_GLOBAL_PROXY_TYPE:
112       JSGlobalProxy::cast(this)->JSGlobalProxyVerify();
113       break;
114     case JS_GLOBAL_OBJECT_TYPE:
115       JSGlobalObject::cast(this)->JSGlobalObjectVerify();
116       break;
117     case JS_BUILTINS_OBJECT_TYPE:
118       JSBuiltinsObject::cast(this)->JSBuiltinsObjectVerify();
119       break;
120     case CELL_TYPE:
121       Cell::cast(this)->CellVerify();
122       break;
123     case PROPERTY_CELL_TYPE:
124       PropertyCell::cast(this)->PropertyCellVerify();
125       break;
126     case JS_ARRAY_TYPE:
127       JSArray::cast(this)->JSArrayVerify();
128       break;
129     case JS_SET_TYPE:
130       JSSet::cast(this)->JSSetVerify();
131       break;
132     case JS_MAP_TYPE:
133       JSMap::cast(this)->JSMapVerify();
134       break;
135     case JS_SET_ITERATOR_TYPE:
136       JSSetIterator::cast(this)->JSSetIteratorVerify();
137       break;
138     case JS_MAP_ITERATOR_TYPE:
139       JSMapIterator::cast(this)->JSMapIteratorVerify();
140       break;
141     case JS_WEAK_MAP_TYPE:
142       JSWeakMap::cast(this)->JSWeakMapVerify();
143       break;
144     case JS_WEAK_SET_TYPE:
145       JSWeakSet::cast(this)->JSWeakSetVerify();
146       break;
147     case JS_REGEXP_TYPE:
148       JSRegExp::cast(this)->JSRegExpVerify();
149       break;
150     case FILLER_TYPE:
151       break;
152     case JS_PROXY_TYPE:
153       JSProxy::cast(this)->JSProxyVerify();
154       break;
155     case JS_FUNCTION_PROXY_TYPE:
156       JSFunctionProxy::cast(this)->JSFunctionProxyVerify();
157       break;
158     case FOREIGN_TYPE:
159       Foreign::cast(this)->ForeignVerify();
160       break;
161     case SHARED_FUNCTION_INFO_TYPE:
162       SharedFunctionInfo::cast(this)->SharedFunctionInfoVerify();
163       break;
164     case JS_MESSAGE_OBJECT_TYPE:
165       JSMessageObject::cast(this)->JSMessageObjectVerify();
166       break;
167     case JS_ARRAY_BUFFER_TYPE:
168       JSArrayBuffer::cast(this)->JSArrayBufferVerify();
169       break;
170     case JS_TYPED_ARRAY_TYPE:
171       JSTypedArray::cast(this)->JSTypedArrayVerify();
172       break;
173     case JS_DATA_VIEW_TYPE:
174       JSDataView::cast(this)->JSDataViewVerify();
175       break;
176 
177 #define MAKE_STRUCT_CASE(NAME, Name, name) \
178   case NAME##_TYPE:                        \
179     Name::cast(this)->Name##Verify();      \
180     break;
181     STRUCT_LIST(MAKE_STRUCT_CASE)
182 #undef MAKE_STRUCT_CASE
183 
184     default:
185       UNREACHABLE();
186       break;
187   }
188 }
189 
190 
VerifyHeapPointer(Object * p)191 void HeapObject::VerifyHeapPointer(Object* p) {
192   CHECK(p->IsHeapObject());
193   HeapObject* ho = HeapObject::cast(p);
194   CHECK(ho->GetHeap()->Contains(ho));
195 }
196 
197 
SymbolVerify()198 void Symbol::SymbolVerify() {
199   CHECK(IsSymbol());
200   CHECK(HasHashCode());
201   CHECK_GT(Hash(), 0);
202   CHECK(name()->IsUndefined() || name()->IsString());
203   CHECK(flags()->IsSmi());
204 }
205 
206 
HeapNumberVerify()207 void HeapNumber::HeapNumberVerify() {
208   CHECK(IsHeapNumber());
209 }
210 
211 
ByteArrayVerify()212 void ByteArray::ByteArrayVerify() {
213   CHECK(IsByteArray());
214 }
215 
216 
FreeSpaceVerify()217 void FreeSpace::FreeSpaceVerify() {
218   CHECK(IsFreeSpace());
219 }
220 
221 
222 #define EXTERNAL_ARRAY_VERIFY(Type, type, TYPE, ctype, size)                  \
223   void External##Type##Array::External##Type##ArrayVerify() {                 \
224     CHECK(IsExternal##Type##Array());                                         \
225   }
226 
TYPED_ARRAYS(EXTERNAL_ARRAY_VERIFY)227 TYPED_ARRAYS(EXTERNAL_ARRAY_VERIFY)
228 #undef EXTERNAL_ARRAY_VERIFY
229 
230 
231 template <class Traits>
232 void FixedTypedArray<Traits>::FixedTypedArrayVerify() {
233   CHECK(IsHeapObject() &&
234         HeapObject::cast(this)->map()->instance_type() ==
235             Traits::kInstanceType);
236 }
237 
238 
ElementsAreSafeToExamine()239 bool JSObject::ElementsAreSafeToExamine() {
240   // If a GC was caused while constructing this object, the elements
241   // pointer may point to a one pointer filler map.
242   return reinterpret_cast<Map*>(elements()) !=
243       GetHeap()->one_pointer_filler_map();
244 }
245 
246 
JSObjectVerify()247 void JSObject::JSObjectVerify() {
248   VerifyHeapPointer(properties());
249   VerifyHeapPointer(elements());
250 
251   if (GetElementsKind() == SLOPPY_ARGUMENTS_ELEMENTS) {
252     CHECK(this->elements()->IsFixedArray());
253     CHECK_GE(this->elements()->length(), 2);
254   }
255 
256   if (HasFastProperties()) {
257     CHECK_EQ(map()->unused_property_fields(),
258              (map()->inobject_properties() + properties()->length() -
259               map()->NextFreePropertyIndex()));
260     DescriptorArray* descriptors = map()->instance_descriptors();
261     for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
262       if (descriptors->GetDetails(i).type() == FIELD) {
263         Representation r = descriptors->GetDetails(i).representation();
264         FieldIndex index = FieldIndex::ForDescriptor(map(), i);
265         Object* value = RawFastPropertyAt(index);
266         if (r.IsDouble()) ASSERT(value->IsHeapNumber());
267         if (value->IsUninitialized()) continue;
268         if (r.IsSmi()) ASSERT(value->IsSmi());
269         if (r.IsHeapObject()) ASSERT(value->IsHeapObject());
270         HeapType* field_type = descriptors->GetFieldType(i);
271         if (r.IsNone()) {
272           CHECK(field_type->Is(HeapType::None()));
273         } else if (!HeapType::Any()->Is(field_type)) {
274           CHECK(!field_type->NowStable() || field_type->NowContains(value));
275         }
276       }
277     }
278   }
279 
280   // If a GC was caused while constructing this object, the elements
281   // pointer may point to a one pointer filler map.
282   if (ElementsAreSafeToExamine()) {
283     CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
284               (elements() == GetHeap()->empty_fixed_array())),
285              (elements()->map() == GetHeap()->fixed_array_map() ||
286               elements()->map() == GetHeap()->fixed_cow_array_map()));
287     CHECK(map()->has_fast_object_elements() == HasFastObjectElements());
288   }
289 }
290 
291 
MapVerify()292 void Map::MapVerify() {
293   Heap* heap = GetHeap();
294   CHECK(!heap->InNewSpace(this));
295   CHECK(FIRST_TYPE <= instance_type() && instance_type() <= LAST_TYPE);
296   CHECK(instance_size() == kVariableSizeSentinel ||
297          (kPointerSize <= instance_size() &&
298           instance_size() < heap->Capacity()));
299   VerifyHeapPointer(prototype());
300   VerifyHeapPointer(instance_descriptors());
301   SLOW_ASSERT(instance_descriptors()->IsSortedNoDuplicates());
302   if (HasTransitionArray()) {
303     SLOW_ASSERT(transitions()->IsSortedNoDuplicates());
304     SLOW_ASSERT(transitions()->IsConsistentWithBackPointers(this));
305   }
306 }
307 
308 
SharedMapVerify()309 void Map::SharedMapVerify() {
310   MapVerify();
311   CHECK(is_shared());
312   CHECK(instance_descriptors()->IsEmpty());
313   CHECK_EQ(0, pre_allocated_property_fields());
314   CHECK_EQ(0, unused_property_fields());
315   CHECK_EQ(StaticVisitorBase::GetVisitorId(instance_type(), instance_size()),
316       visitor_id());
317 }
318 
319 
VerifyOmittedMapChecks()320 void Map::VerifyOmittedMapChecks() {
321   if (!FLAG_omit_map_checks_for_leaf_maps) return;
322   if (!is_stable() ||
323       is_deprecated() ||
324       HasTransitionArray() ||
325       is_dictionary_map()) {
326     CHECK_EQ(0, dependent_code()->number_of_entries(
327         DependentCode::kPrototypeCheckGroup));
328   }
329 }
330 
331 
CodeCacheVerify()332 void CodeCache::CodeCacheVerify() {
333   VerifyHeapPointer(default_cache());
334   VerifyHeapPointer(normal_type_cache());
335   CHECK(default_cache()->IsFixedArray());
336   CHECK(normal_type_cache()->IsUndefined()
337          || normal_type_cache()->IsCodeCacheHashTable());
338 }
339 
340 
PolymorphicCodeCacheVerify()341 void PolymorphicCodeCache::PolymorphicCodeCacheVerify() {
342   VerifyHeapPointer(cache());
343   CHECK(cache()->IsUndefined() || cache()->IsPolymorphicCodeCacheHashTable());
344 }
345 
346 
TypeFeedbackInfoVerify()347 void TypeFeedbackInfo::TypeFeedbackInfoVerify() {
348   VerifyObjectField(kStorage1Offset);
349   VerifyObjectField(kStorage2Offset);
350 }
351 
352 
AliasedArgumentsEntryVerify()353 void AliasedArgumentsEntry::AliasedArgumentsEntryVerify() {
354   VerifySmiField(kAliasedContextSlot);
355 }
356 
357 
FixedArrayVerify()358 void FixedArray::FixedArrayVerify() {
359   for (int i = 0; i < length(); i++) {
360     Object* e = get(i);
361     VerifyPointer(e);
362   }
363 }
364 
365 
FixedDoubleArrayVerify()366 void FixedDoubleArray::FixedDoubleArrayVerify() {
367   for (int i = 0; i < length(); i++) {
368     if (!is_the_hole(i)) {
369       double value = get_scalar(i);
370       CHECK(!std::isnan(value) ||
371              (BitCast<uint64_t>(value) ==
372               BitCast<uint64_t>(canonical_not_the_hole_nan_as_double())) ||
373              ((BitCast<uint64_t>(value) & Double::kSignMask) != 0));
374     }
375   }
376 }
377 
378 
ConstantPoolArrayVerify()379 void ConstantPoolArray::ConstantPoolArrayVerify() {
380   CHECK(IsConstantPoolArray());
381   ConstantPoolArray::Iterator code_iter(this, ConstantPoolArray::CODE_PTR);
382   while (!code_iter.is_finished()) {
383     Address code_entry = get_code_ptr_entry(code_iter.next_index());
384     VerifyPointer(Code::GetCodeFromTargetAddress(code_entry));
385   }
386   ConstantPoolArray::Iterator heap_iter(this, ConstantPoolArray::HEAP_PTR);
387   while (!heap_iter.is_finished()) {
388     VerifyObjectField(OffsetOfElementAt(heap_iter.next_index()));
389   }
390 }
391 
392 
JSGeneratorObjectVerify()393 void JSGeneratorObject::JSGeneratorObjectVerify() {
394   // In an expression like "new g()", there can be a point where a generator
395   // object is allocated but its fields are all undefined, as it hasn't yet been
396   // initialized by the generator.  Hence these weak checks.
397   VerifyObjectField(kFunctionOffset);
398   VerifyObjectField(kContextOffset);
399   VerifyObjectField(kReceiverOffset);
400   VerifyObjectField(kOperandStackOffset);
401   VerifyObjectField(kContinuationOffset);
402   VerifyObjectField(kStackHandlerIndexOffset);
403 }
404 
405 
JSModuleVerify()406 void JSModule::JSModuleVerify() {
407   VerifyObjectField(kContextOffset);
408   VerifyObjectField(kScopeInfoOffset);
409   CHECK(context()->IsUndefined() ||
410         Context::cast(context())->IsModuleContext());
411 }
412 
413 
JSValueVerify()414 void JSValue::JSValueVerify() {
415   Object* v = value();
416   if (v->IsHeapObject()) {
417     VerifyHeapPointer(v);
418   }
419 }
420 
421 
JSDateVerify()422 void JSDate::JSDateVerify() {
423   if (value()->IsHeapObject()) {
424     VerifyHeapPointer(value());
425   }
426   CHECK(value()->IsUndefined() || value()->IsSmi() || value()->IsHeapNumber());
427   CHECK(year()->IsUndefined() || year()->IsSmi() || year()->IsNaN());
428   CHECK(month()->IsUndefined() || month()->IsSmi() || month()->IsNaN());
429   CHECK(day()->IsUndefined() || day()->IsSmi() || day()->IsNaN());
430   CHECK(weekday()->IsUndefined() || weekday()->IsSmi() || weekday()->IsNaN());
431   CHECK(hour()->IsUndefined() || hour()->IsSmi() || hour()->IsNaN());
432   CHECK(min()->IsUndefined() || min()->IsSmi() || min()->IsNaN());
433   CHECK(sec()->IsUndefined() || sec()->IsSmi() || sec()->IsNaN());
434   CHECK(cache_stamp()->IsUndefined() ||
435         cache_stamp()->IsSmi() ||
436         cache_stamp()->IsNaN());
437 
438   if (month()->IsSmi()) {
439     int month = Smi::cast(this->month())->value();
440     CHECK(0 <= month && month <= 11);
441   }
442   if (day()->IsSmi()) {
443     int day = Smi::cast(this->day())->value();
444     CHECK(1 <= day && day <= 31);
445   }
446   if (hour()->IsSmi()) {
447     int hour = Smi::cast(this->hour())->value();
448     CHECK(0 <= hour && hour <= 23);
449   }
450   if (min()->IsSmi()) {
451     int min = Smi::cast(this->min())->value();
452     CHECK(0 <= min && min <= 59);
453   }
454   if (sec()->IsSmi()) {
455     int sec = Smi::cast(this->sec())->value();
456     CHECK(0 <= sec && sec <= 59);
457   }
458   if (weekday()->IsSmi()) {
459     int weekday = Smi::cast(this->weekday())->value();
460     CHECK(0 <= weekday && weekday <= 6);
461   }
462   if (cache_stamp()->IsSmi()) {
463     CHECK(Smi::cast(cache_stamp())->value() <=
464           Smi::cast(GetIsolate()->date_cache()->stamp())->value());
465   }
466 }
467 
468 
JSMessageObjectVerify()469 void JSMessageObject::JSMessageObjectVerify() {
470   CHECK(IsJSMessageObject());
471   CHECK(type()->IsString());
472   CHECK(arguments()->IsJSArray());
473   VerifyObjectField(kStartPositionOffset);
474   VerifyObjectField(kEndPositionOffset);
475   VerifyObjectField(kArgumentsOffset);
476   VerifyObjectField(kScriptOffset);
477   VerifyObjectField(kStackFramesOffset);
478 }
479 
480 
StringVerify()481 void String::StringVerify() {
482   CHECK(IsString());
483   CHECK(length() >= 0 && length() <= Smi::kMaxValue);
484   if (IsInternalizedString()) {
485     CHECK(!GetHeap()->InNewSpace(this));
486   }
487   if (IsConsString()) {
488     ConsString::cast(this)->ConsStringVerify();
489   } else if (IsSlicedString()) {
490     SlicedString::cast(this)->SlicedStringVerify();
491   }
492 }
493 
494 
ConsStringVerify()495 void ConsString::ConsStringVerify() {
496   CHECK(this->first()->IsString());
497   CHECK(this->second() == GetHeap()->empty_string() ||
498         this->second()->IsString());
499   CHECK(this->length() >= ConsString::kMinLength);
500   CHECK(this->length() == this->first()->length() + this->second()->length());
501   if (this->IsFlat()) {
502     // A flat cons can only be created by String::SlowTryFlatten.
503     // Afterwards, the first part may be externalized.
504     CHECK(this->first()->IsSeqString() || this->first()->IsExternalString());
505   }
506 }
507 
508 
SlicedStringVerify()509 void SlicedString::SlicedStringVerify() {
510   CHECK(!this->parent()->IsConsString());
511   CHECK(!this->parent()->IsSlicedString());
512   CHECK(this->length() >= SlicedString::kMinLength);
513 }
514 
515 
JSFunctionVerify()516 void JSFunction::JSFunctionVerify() {
517   CHECK(IsJSFunction());
518   VerifyObjectField(kPrototypeOrInitialMapOffset);
519   VerifyObjectField(kNextFunctionLinkOffset);
520   CHECK(code()->IsCode());
521   CHECK(next_function_link() == NULL ||
522         next_function_link()->IsUndefined() ||
523         next_function_link()->IsJSFunction());
524 }
525 
526 
SharedFunctionInfoVerify()527 void SharedFunctionInfo::SharedFunctionInfoVerify() {
528   CHECK(IsSharedFunctionInfo());
529   VerifyObjectField(kNameOffset);
530   VerifyObjectField(kCodeOffset);
531   VerifyObjectField(kOptimizedCodeMapOffset);
532   VerifyObjectField(kFeedbackVectorOffset);
533   VerifyObjectField(kScopeInfoOffset);
534   VerifyObjectField(kInstanceClassNameOffset);
535   VerifyObjectField(kFunctionDataOffset);
536   VerifyObjectField(kScriptOffset);
537   VerifyObjectField(kDebugInfoOffset);
538 }
539 
540 
JSGlobalProxyVerify()541 void JSGlobalProxy::JSGlobalProxyVerify() {
542   CHECK(IsJSGlobalProxy());
543   JSObjectVerify();
544   VerifyObjectField(JSGlobalProxy::kNativeContextOffset);
545   // Make sure that this object has no properties, elements.
546   CHECK_EQ(0, properties()->length());
547   CHECK(HasFastSmiElements());
548   CHECK_EQ(0, FixedArray::cast(elements())->length());
549 }
550 
551 
JSGlobalObjectVerify()552 void JSGlobalObject::JSGlobalObjectVerify() {
553   CHECK(IsJSGlobalObject());
554   JSObjectVerify();
555   for (int i = GlobalObject::kBuiltinsOffset;
556        i < JSGlobalObject::kSize;
557        i += kPointerSize) {
558     VerifyObjectField(i);
559   }
560 }
561 
562 
JSBuiltinsObjectVerify()563 void JSBuiltinsObject::JSBuiltinsObjectVerify() {
564   CHECK(IsJSBuiltinsObject());
565   JSObjectVerify();
566   for (int i = GlobalObject::kBuiltinsOffset;
567        i < JSBuiltinsObject::kSize;
568        i += kPointerSize) {
569     VerifyObjectField(i);
570   }
571 }
572 
573 
OddballVerify()574 void Oddball::OddballVerify() {
575   CHECK(IsOddball());
576   Heap* heap = GetHeap();
577   VerifyHeapPointer(to_string());
578   Object* number = to_number();
579   if (number->IsHeapObject()) {
580     CHECK(number == heap->nan_value());
581   } else {
582     CHECK(number->IsSmi());
583     int value = Smi::cast(number)->value();
584     // Hidden oddballs have negative smis.
585     const int kLeastHiddenOddballNumber = -5;
586     CHECK_LE(value, 1);
587     CHECK(value >= kLeastHiddenOddballNumber);
588   }
589   if (map() == heap->undefined_map()) {
590     CHECK(this == heap->undefined_value());
591   } else if (map() == heap->the_hole_map()) {
592     CHECK(this == heap->the_hole_value());
593   } else if (map() == heap->null_map()) {
594     CHECK(this == heap->null_value());
595   } else if (map() == heap->boolean_map()) {
596     CHECK(this == heap->true_value() ||
597           this == heap->false_value());
598   } else if (map() == heap->uninitialized_map()) {
599     CHECK(this == heap->uninitialized_value());
600   } else if (map() == heap->no_interceptor_result_sentinel_map()) {
601     CHECK(this == heap->no_interceptor_result_sentinel());
602   } else if (map() == heap->arguments_marker_map()) {
603     CHECK(this == heap->arguments_marker());
604   } else if (map() == heap->termination_exception_map()) {
605     CHECK(this == heap->termination_exception());
606   } else if (map() == heap->exception_map()) {
607     CHECK(this == heap->exception());
608   } else {
609     UNREACHABLE();
610   }
611 }
612 
613 
CellVerify()614 void Cell::CellVerify() {
615   CHECK(IsCell());
616   VerifyObjectField(kValueOffset);
617 }
618 
619 
PropertyCellVerify()620 void PropertyCell::PropertyCellVerify() {
621   CHECK(IsPropertyCell());
622   VerifyObjectField(kValueOffset);
623   VerifyObjectField(kTypeOffset);
624 }
625 
626 
CodeVerify()627 void Code::CodeVerify() {
628   CHECK(IsAligned(reinterpret_cast<intptr_t>(instruction_start()),
629                   kCodeAlignment));
630   relocation_info()->ObjectVerify();
631   Address last_gc_pc = NULL;
632   Isolate* isolate = GetIsolate();
633   for (RelocIterator it(this); !it.done(); it.next()) {
634     it.rinfo()->Verify(isolate);
635     // Ensure that GC will not iterate twice over the same pointer.
636     if (RelocInfo::IsGCRelocMode(it.rinfo()->rmode())) {
637       CHECK(it.rinfo()->pc() != last_gc_pc);
638       last_gc_pc = it.rinfo()->pc();
639     }
640   }
641 }
642 
643 
VerifyEmbeddedObjectsDependency()644 void Code::VerifyEmbeddedObjectsDependency() {
645   if (!CanContainWeakObjects()) return;
646   DisallowHeapAllocation no_gc;
647   Isolate* isolate = GetIsolate();
648   HandleScope scope(isolate);
649   int mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
650   for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
651     Object* obj = it.rinfo()->target_object();
652     if (IsWeakObject(obj)) {
653       if (obj->IsMap()) {
654         Map* map = Map::cast(obj);
655         DependentCode::DependencyGroup group = is_optimized_code() ?
656             DependentCode::kWeakCodeGroup : DependentCode::kWeakICGroup;
657         CHECK(map->dependent_code()->Contains(group, this));
658       } else if (obj->IsJSObject()) {
659         Object* raw_table = GetIsolate()->heap()->weak_object_to_code_table();
660         WeakHashTable* table = WeakHashTable::cast(raw_table);
661         Handle<Object> key_obj(obj, isolate);
662         CHECK(DependentCode::cast(table->Lookup(key_obj))->Contains(
663             DependentCode::kWeakCodeGroup, this));
664       }
665     }
666   }
667 }
668 
669 
JSArrayVerify()670 void JSArray::JSArrayVerify() {
671   JSObjectVerify();
672   CHECK(length()->IsNumber() || length()->IsUndefined());
673   // If a GC was caused while constructing this array, the elements
674   // pointer may point to a one pointer filler map.
675   if (ElementsAreSafeToExamine()) {
676     CHECK(elements()->IsUndefined() ||
677           elements()->IsFixedArray() ||
678           elements()->IsFixedDoubleArray());
679   }
680 }
681 
682 
JSSetVerify()683 void JSSet::JSSetVerify() {
684   CHECK(IsJSSet());
685   JSObjectVerify();
686   VerifyHeapPointer(table());
687   CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
688   // TODO(arv): Verify OrderedHashTable too.
689 }
690 
691 
JSMapVerify()692 void JSMap::JSMapVerify() {
693   CHECK(IsJSMap());
694   JSObjectVerify();
695   VerifyHeapPointer(table());
696   CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
697   // TODO(arv): Verify OrderedHashTable too.
698 }
699 
700 
JSSetIteratorVerify()701 void JSSetIterator::JSSetIteratorVerify() {
702   CHECK(IsJSSetIterator());
703   JSObjectVerify();
704   VerifyHeapPointer(table());
705   CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
706   CHECK(index()->IsSmi() || index()->IsUndefined());
707   CHECK(kind()->IsSmi() || kind()->IsUndefined());
708 }
709 
710 
JSMapIteratorVerify()711 void JSMapIterator::JSMapIteratorVerify() {
712   CHECK(IsJSMapIterator());
713   JSObjectVerify();
714   VerifyHeapPointer(table());
715   CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
716   CHECK(index()->IsSmi() || index()->IsUndefined());
717   CHECK(kind()->IsSmi() || kind()->IsUndefined());
718 }
719 
720 
JSWeakMapVerify()721 void JSWeakMap::JSWeakMapVerify() {
722   CHECK(IsJSWeakMap());
723   JSObjectVerify();
724   VerifyHeapPointer(table());
725   CHECK(table()->IsHashTable() || table()->IsUndefined());
726 }
727 
728 
JSWeakSetVerify()729 void JSWeakSet::JSWeakSetVerify() {
730   CHECK(IsJSWeakSet());
731   JSObjectVerify();
732   VerifyHeapPointer(table());
733   CHECK(table()->IsHashTable() || table()->IsUndefined());
734 }
735 
736 
JSRegExpVerify()737 void JSRegExp::JSRegExpVerify() {
738   JSObjectVerify();
739   CHECK(data()->IsUndefined() || data()->IsFixedArray());
740   switch (TypeTag()) {
741     case JSRegExp::ATOM: {
742       FixedArray* arr = FixedArray::cast(data());
743       CHECK(arr->get(JSRegExp::kAtomPatternIndex)->IsString());
744       break;
745     }
746     case JSRegExp::IRREGEXP: {
747       bool is_native = RegExpImpl::UsesNativeRegExp();
748 
749       FixedArray* arr = FixedArray::cast(data());
750       Object* ascii_data = arr->get(JSRegExp::kIrregexpASCIICodeIndex);
751       // Smi : Not compiled yet (-1) or code prepared for flushing.
752       // JSObject: Compilation error.
753       // Code/ByteArray: Compiled code.
754       CHECK(ascii_data->IsSmi() ||
755              (is_native ? ascii_data->IsCode() : ascii_data->IsByteArray()));
756       Object* uc16_data = arr->get(JSRegExp::kIrregexpUC16CodeIndex);
757       CHECK(uc16_data->IsSmi() ||
758              (is_native ? uc16_data->IsCode() : uc16_data->IsByteArray()));
759 
760       Object* ascii_saved = arr->get(JSRegExp::kIrregexpASCIICodeSavedIndex);
761       CHECK(ascii_saved->IsSmi() || ascii_saved->IsString() ||
762              ascii_saved->IsCode());
763       Object* uc16_saved = arr->get(JSRegExp::kIrregexpUC16CodeSavedIndex);
764       CHECK(uc16_saved->IsSmi() || uc16_saved->IsString() ||
765              uc16_saved->IsCode());
766 
767       CHECK(arr->get(JSRegExp::kIrregexpCaptureCountIndex)->IsSmi());
768       CHECK(arr->get(JSRegExp::kIrregexpMaxRegisterCountIndex)->IsSmi());
769       break;
770     }
771     default:
772       CHECK_EQ(JSRegExp::NOT_COMPILED, TypeTag());
773       CHECK(data()->IsUndefined());
774       break;
775   }
776 }
777 
778 
JSProxyVerify()779 void JSProxy::JSProxyVerify() {
780   CHECK(IsJSProxy());
781   VerifyPointer(handler());
782   CHECK(hash()->IsSmi() || hash()->IsUndefined());
783 }
784 
785 
JSFunctionProxyVerify()786 void JSFunctionProxy::JSFunctionProxyVerify() {
787   CHECK(IsJSFunctionProxy());
788   JSProxyVerify();
789   VerifyPointer(call_trap());
790   VerifyPointer(construct_trap());
791 }
792 
793 
JSArrayBufferVerify()794 void JSArrayBuffer::JSArrayBufferVerify() {
795   CHECK(IsJSArrayBuffer());
796   JSObjectVerify();
797   VerifyPointer(byte_length());
798   CHECK(byte_length()->IsSmi() || byte_length()->IsHeapNumber()
799         || byte_length()->IsUndefined());
800 }
801 
802 
JSArrayBufferViewVerify()803 void JSArrayBufferView::JSArrayBufferViewVerify() {
804   CHECK(IsJSArrayBufferView());
805   JSObjectVerify();
806   VerifyPointer(buffer());
807   CHECK(buffer()->IsJSArrayBuffer() || buffer()->IsUndefined()
808         || buffer() == Smi::FromInt(0));
809 
810   VerifyPointer(byte_offset());
811   CHECK(byte_offset()->IsSmi() || byte_offset()->IsHeapNumber()
812         || byte_offset()->IsUndefined());
813 
814   VerifyPointer(byte_length());
815   CHECK(byte_length()->IsSmi() || byte_length()->IsHeapNumber()
816         || byte_length()->IsUndefined());
817 }
818 
819 
JSTypedArrayVerify()820 void JSTypedArray::JSTypedArrayVerify() {
821   CHECK(IsJSTypedArray());
822   JSArrayBufferViewVerify();
823   VerifyPointer(length());
824   CHECK(length()->IsSmi() || length()->IsHeapNumber()
825         || length()->IsUndefined());
826 
827   VerifyPointer(elements());
828 }
829 
830 
JSDataViewVerify()831 void JSDataView::JSDataViewVerify() {
832   CHECK(IsJSDataView());
833   JSArrayBufferViewVerify();
834 }
835 
836 
ForeignVerify()837 void Foreign::ForeignVerify() {
838   CHECK(IsForeign());
839 }
840 
841 
BoxVerify()842 void Box::BoxVerify() {
843   CHECK(IsBox());
844   value()->ObjectVerify();
845 }
846 
847 
AccessorInfoVerify()848 void AccessorInfo::AccessorInfoVerify() {
849   VerifyPointer(name());
850   VerifyPointer(flag());
851   VerifyPointer(expected_receiver_type());
852 }
853 
854 
ExecutableAccessorInfoVerify()855 void ExecutableAccessorInfo::ExecutableAccessorInfoVerify() {
856   CHECK(IsExecutableAccessorInfo());
857   AccessorInfoVerify();
858   VerifyPointer(getter());
859   VerifyPointer(setter());
860   VerifyPointer(data());
861 }
862 
863 
DeclaredAccessorDescriptorVerify()864 void DeclaredAccessorDescriptor::DeclaredAccessorDescriptorVerify() {
865   CHECK(IsDeclaredAccessorDescriptor());
866   VerifyPointer(serialized_data());
867 }
868 
869 
DeclaredAccessorInfoVerify()870 void DeclaredAccessorInfo::DeclaredAccessorInfoVerify() {
871   CHECK(IsDeclaredAccessorInfo());
872   AccessorInfoVerify();
873   VerifyPointer(descriptor());
874 }
875 
876 
AccessorPairVerify()877 void AccessorPair::AccessorPairVerify() {
878   CHECK(IsAccessorPair());
879   VerifyPointer(getter());
880   VerifyPointer(setter());
881   VerifySmiField(kAccessFlagsOffset);
882 }
883 
884 
AccessCheckInfoVerify()885 void AccessCheckInfo::AccessCheckInfoVerify() {
886   CHECK(IsAccessCheckInfo());
887   VerifyPointer(named_callback());
888   VerifyPointer(indexed_callback());
889   VerifyPointer(data());
890 }
891 
892 
InterceptorInfoVerify()893 void InterceptorInfo::InterceptorInfoVerify() {
894   CHECK(IsInterceptorInfo());
895   VerifyPointer(getter());
896   VerifyPointer(setter());
897   VerifyPointer(query());
898   VerifyPointer(deleter());
899   VerifyPointer(enumerator());
900   VerifyPointer(data());
901 }
902 
903 
CallHandlerInfoVerify()904 void CallHandlerInfo::CallHandlerInfoVerify() {
905   CHECK(IsCallHandlerInfo());
906   VerifyPointer(callback());
907   VerifyPointer(data());
908 }
909 
910 
TemplateInfoVerify()911 void TemplateInfo::TemplateInfoVerify() {
912   VerifyPointer(tag());
913   VerifyPointer(property_list());
914   VerifyPointer(property_accessors());
915 }
916 
917 
FunctionTemplateInfoVerify()918 void FunctionTemplateInfo::FunctionTemplateInfoVerify() {
919   CHECK(IsFunctionTemplateInfo());
920   TemplateInfoVerify();
921   VerifyPointer(serial_number());
922   VerifyPointer(call_code());
923   VerifyPointer(prototype_template());
924   VerifyPointer(parent_template());
925   VerifyPointer(named_property_handler());
926   VerifyPointer(indexed_property_handler());
927   VerifyPointer(instance_template());
928   VerifyPointer(signature());
929   VerifyPointer(access_check_info());
930 }
931 
932 
ObjectTemplateInfoVerify()933 void ObjectTemplateInfo::ObjectTemplateInfoVerify() {
934   CHECK(IsObjectTemplateInfo());
935   TemplateInfoVerify();
936   VerifyPointer(constructor());
937   VerifyPointer(internal_field_count());
938 }
939 
940 
SignatureInfoVerify()941 void SignatureInfo::SignatureInfoVerify() {
942   CHECK(IsSignatureInfo());
943   VerifyPointer(receiver());
944   VerifyPointer(args());
945 }
946 
947 
TypeSwitchInfoVerify()948 void TypeSwitchInfo::TypeSwitchInfoVerify() {
949   CHECK(IsTypeSwitchInfo());
950   VerifyPointer(types());
951 }
952 
953 
AllocationSiteVerify()954 void AllocationSite::AllocationSiteVerify() {
955   CHECK(IsAllocationSite());
956 }
957 
958 
AllocationMementoVerify()959 void AllocationMemento::AllocationMementoVerify() {
960   CHECK(IsAllocationMemento());
961   VerifyHeapPointer(allocation_site());
962   CHECK(!IsValid() || GetAllocationSite()->IsAllocationSite());
963 }
964 
965 
ScriptVerify()966 void Script::ScriptVerify() {
967   CHECK(IsScript());
968   VerifyPointer(source());
969   VerifyPointer(name());
970   line_offset()->SmiVerify();
971   column_offset()->SmiVerify();
972   VerifyPointer(wrapper());
973   type()->SmiVerify();
974   VerifyPointer(line_ends());
975   VerifyPointer(id());
976 }
977 
978 
JSFunctionResultCacheVerify()979 void JSFunctionResultCache::JSFunctionResultCacheVerify() {
980   JSFunction::cast(get(kFactoryIndex))->ObjectVerify();
981 
982   int size = Smi::cast(get(kCacheSizeIndex))->value();
983   CHECK(kEntriesIndex <= size);
984   CHECK(size <= length());
985   CHECK_EQ(0, size % kEntrySize);
986 
987   int finger = Smi::cast(get(kFingerIndex))->value();
988   CHECK(kEntriesIndex <= finger);
989   CHECK((finger < size) || (finger == kEntriesIndex && finger == size));
990   CHECK_EQ(0, finger % kEntrySize);
991 
992   if (FLAG_enable_slow_asserts) {
993     for (int i = kEntriesIndex; i < size; i++) {
994       CHECK(!get(i)->IsTheHole());
995       get(i)->ObjectVerify();
996     }
997     for (int i = size; i < length(); i++) {
998       CHECK(get(i)->IsTheHole());
999       get(i)->ObjectVerify();
1000     }
1001   }
1002 }
1003 
1004 
NormalizedMapCacheVerify()1005 void NormalizedMapCache::NormalizedMapCacheVerify() {
1006   FixedArray::cast(this)->FixedArrayVerify();
1007   if (FLAG_enable_slow_asserts) {
1008     for (int i = 0; i < length(); i++) {
1009       Object* e = FixedArray::get(i);
1010       if (e->IsMap()) {
1011         Map::cast(e)->SharedMapVerify();
1012       } else {
1013         CHECK(e->IsUndefined());
1014       }
1015     }
1016   }
1017 }
1018 
1019 
DebugInfoVerify()1020 void DebugInfo::DebugInfoVerify() {
1021   CHECK(IsDebugInfo());
1022   VerifyPointer(shared());
1023   VerifyPointer(original_code());
1024   VerifyPointer(code());
1025   VerifyPointer(break_points());
1026 }
1027 
1028 
BreakPointInfoVerify()1029 void BreakPointInfo::BreakPointInfoVerify() {
1030   CHECK(IsBreakPointInfo());
1031   code_position()->SmiVerify();
1032   source_position()->SmiVerify();
1033   statement_position()->SmiVerify();
1034   VerifyPointer(break_point_objects());
1035 }
1036 #endif  // VERIFY_HEAP
1037 
1038 #ifdef DEBUG
1039 
IncrementSpillStatistics(SpillInformation * info)1040 void JSObject::IncrementSpillStatistics(SpillInformation* info) {
1041   info->number_of_objects_++;
1042   // Named properties
1043   if (HasFastProperties()) {
1044     info->number_of_objects_with_fast_properties_++;
1045     info->number_of_fast_used_fields_   += map()->NextFreePropertyIndex();
1046     info->number_of_fast_unused_fields_ += map()->unused_property_fields();
1047   } else {
1048     NameDictionary* dict = property_dictionary();
1049     info->number_of_slow_used_properties_ += dict->NumberOfElements();
1050     info->number_of_slow_unused_properties_ +=
1051         dict->Capacity() - dict->NumberOfElements();
1052   }
1053   // Indexed properties
1054   switch (GetElementsKind()) {
1055     case FAST_HOLEY_SMI_ELEMENTS:
1056     case FAST_SMI_ELEMENTS:
1057     case FAST_HOLEY_DOUBLE_ELEMENTS:
1058     case FAST_DOUBLE_ELEMENTS:
1059     case FAST_HOLEY_ELEMENTS:
1060     case FAST_ELEMENTS: {
1061       info->number_of_objects_with_fast_elements_++;
1062       int holes = 0;
1063       FixedArray* e = FixedArray::cast(elements());
1064       int len = e->length();
1065       Heap* heap = GetHeap();
1066       for (int i = 0; i < len; i++) {
1067         if (e->get(i) == heap->the_hole_value()) holes++;
1068       }
1069       info->number_of_fast_used_elements_   += len - holes;
1070       info->number_of_fast_unused_elements_ += holes;
1071       break;
1072     }
1073 
1074 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
1075     case EXTERNAL_##TYPE##_ELEMENTS:                                          \
1076     case TYPE##_ELEMENTS:
1077 
1078     TYPED_ARRAYS(TYPED_ARRAY_CASE)
1079 #undef TYPED_ARRAY_CASE
1080     { info->number_of_objects_with_fast_elements_++;
1081       FixedArrayBase* e = FixedArrayBase::cast(elements());
1082       info->number_of_fast_used_elements_ += e->length();
1083       break;
1084     }
1085     case DICTIONARY_ELEMENTS: {
1086       SeededNumberDictionary* dict = element_dictionary();
1087       info->number_of_slow_used_elements_ += dict->NumberOfElements();
1088       info->number_of_slow_unused_elements_ +=
1089           dict->Capacity() - dict->NumberOfElements();
1090       break;
1091     }
1092     case SLOPPY_ARGUMENTS_ELEMENTS:
1093       break;
1094   }
1095 }
1096 
1097 
Clear()1098 void JSObject::SpillInformation::Clear() {
1099   number_of_objects_ = 0;
1100   number_of_objects_with_fast_properties_ = 0;
1101   number_of_objects_with_fast_elements_ = 0;
1102   number_of_fast_used_fields_ = 0;
1103   number_of_fast_unused_fields_ = 0;
1104   number_of_slow_used_properties_ = 0;
1105   number_of_slow_unused_properties_ = 0;
1106   number_of_fast_used_elements_ = 0;
1107   number_of_fast_unused_elements_ = 0;
1108   number_of_slow_used_elements_ = 0;
1109   number_of_slow_unused_elements_ = 0;
1110 }
1111 
1112 
Print()1113 void JSObject::SpillInformation::Print() {
1114   PrintF("\n  JSObject Spill Statistics (#%d):\n", number_of_objects_);
1115 
1116   PrintF("    - fast properties (#%d): %d (used) %d (unused)\n",
1117          number_of_objects_with_fast_properties_,
1118          number_of_fast_used_fields_, number_of_fast_unused_fields_);
1119 
1120   PrintF("    - slow properties (#%d): %d (used) %d (unused)\n",
1121          number_of_objects_ - number_of_objects_with_fast_properties_,
1122          number_of_slow_used_properties_, number_of_slow_unused_properties_);
1123 
1124   PrintF("    - fast elements (#%d): %d (used) %d (unused)\n",
1125          number_of_objects_with_fast_elements_,
1126          number_of_fast_used_elements_, number_of_fast_unused_elements_);
1127 
1128   PrintF("    - slow elements (#%d): %d (used) %d (unused)\n",
1129          number_of_objects_ - number_of_objects_with_fast_elements_,
1130          number_of_slow_used_elements_, number_of_slow_unused_elements_);
1131 
1132   PrintF("\n");
1133 }
1134 
1135 
IsSortedNoDuplicates(int valid_entries)1136 bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
1137   if (valid_entries == -1) valid_entries = number_of_descriptors();
1138   Name* current_key = NULL;
1139   uint32_t current = 0;
1140   for (int i = 0; i < number_of_descriptors(); i++) {
1141     Name* key = GetSortedKey(i);
1142     if (key == current_key) {
1143       PrintDescriptors();
1144       return false;
1145     }
1146     current_key = key;
1147     uint32_t hash = GetSortedKey(i)->Hash();
1148     if (hash < current) {
1149       PrintDescriptors();
1150       return false;
1151     }
1152     current = hash;
1153   }
1154   return true;
1155 }
1156 
1157 
IsSortedNoDuplicates(int valid_entries)1158 bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
1159   ASSERT(valid_entries == -1);
1160   Name* current_key = NULL;
1161   uint32_t current = 0;
1162   for (int i = 0; i < number_of_transitions(); i++) {
1163     Name* key = GetSortedKey(i);
1164     if (key == current_key) {
1165       PrintTransitions();
1166       return false;
1167     }
1168     current_key = key;
1169     uint32_t hash = GetSortedKey(i)->Hash();
1170     if (hash < current) {
1171       PrintTransitions();
1172       return false;
1173     }
1174     current = hash;
1175   }
1176   return true;
1177 }
1178 
1179 
CheckOneBackPointer(Map * current_map,Object * target)1180 static bool CheckOneBackPointer(Map* current_map, Object* target) {
1181   return !target->IsMap() || Map::cast(target)->GetBackPointer() == current_map;
1182 }
1183 
1184 
IsConsistentWithBackPointers(Map * current_map)1185 bool TransitionArray::IsConsistentWithBackPointers(Map* current_map) {
1186   for (int i = 0; i < number_of_transitions(); ++i) {
1187     if (!CheckOneBackPointer(current_map, GetTarget(i))) return false;
1188   }
1189   return true;
1190 }
1191 
1192 
1193 #endif  // DEBUG
1194 
1195 } }  // namespace v8::internal
1196